1015 matches found
CVE-2024-56329
Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a...
CVE-2024-56329
CVE-2024-56329 affects the Socialstream package for Laravel Jetstream (joelbutcher/socialstream). The vulnerability arises during social account linking to an already authenticated user, where a missing confirmation step allows an account takeover risk. The issue is worsened when the Socialite co...
CVE-2024-56329 Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream
Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a...
CVE-2024-56329 Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream
Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication allowing an attacker to take over user accounts by exploiting the lack of a confirmation step when linking a social account to an already authenticated user. Remediation Upgrade joelbutcher/socialstream to versio...
GHSA-3Q97-VJPP-C8RP Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback
Description When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if -stateless is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure th...
Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback
Description When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if -stateless is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure th...
CVE-2024-56329: Improper Authentication
Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a...
PT-2024-36791 · Unknown +1 · Wp Social Stream +1
Name of the Vulnerable Software and Affected Versions: Socialstream versions prior to 6.2 Description: The issue arises when linking a social account to an already authenticated user, as there is a lack of a confirmation step, introducing a security risk. This risk is increased if -stateless is...
WordPress Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) plugin <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter vulnerability
Authenticated Administrator+ SQL Injection via postid Parameter vulnerability discovered by kr0d in WordPress Plugin Internal Linking for SEO traffic & Ranking – Auto internal links 100% automatic versions = 1.2.1...
CVE-2024-11009: Improper Neutralization of Special Elements used in an SQL Command
The Internal Linking for SEO traffic & Ranking – Auto internal links 100% automatic plugin for WordPress is vulnerable to time-based SQL Injection via the ‘postid’ parameter in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of...
WordPress Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) Plugin <= 1.2.1 is vulnerable to SQL Injection
Software Internal Linking for SEO traffic & Ranking – Auto internal links 100% automatic Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-11009 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID...
Panda Security Dome 后置链接漏洞
Panda Security Dome is an antivirus product for ransomware and spyware from Spanish company Panda Security. Panda Security Dome suffers from a back-linking vulnerability that originates from the link-following mechanism in the PSANHost executable, which could lead to a local attacker deleting an...
PT-2024-31544
Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 Description The issue allows an attacker to construct an XLSX file that links images from arbitrary paths. When embedding...
[SECURITY] Fedora 41 Update: libell-0.69-1.fc41
The Embedded Linux Library ELL provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kernel, C standard library, and libdl for dynamic linking. While ELL is designed to be efficient and compact enough for use on embedded Linux platforms, ...
The vulnerability of the OLE DB driver for SQL Server on Windows operating systems arises from insufficient validation of input data, allowing attackers to exploit their privileges.
The vulnerability of the OLE DB driver for SQL Server on Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...
PT-2024-6305 · Microsoft · Sql Server
Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server affected versions not specified Description: The issue is related to insufficient input validation in the OLE DB driver for SQL Server on Windows operating systems. This can be exploited by a remote attacker to disclose...
The vulnerability of the Windows OLE operating system component, which allows a hacker to execute arbitrary code.
The vulnerability of the Windows OLE operating system is related to overflow in the “heap”. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
