CVE-2024-2698

CVE-2024-2698 : In FreeIPA, initial MS-SFU handling with MIT Kerberos could grant forwardable on S4U2Self due to a missing condition. Upstream changes required a special case for check_allowed_to_delegate() when the target service arg is NULL (KDC probing general constrained delegation, not a spe...

TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

GHSA-F777-F784-36GM TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

TYPO3 Security Misconfiguration for Backend User Accounts

When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...

GHSA-C5MJ-39CF-3PP5 TYPO3 Security Misconfiguration for Backend User Accounts

When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...

Exposure Of Sensitive Information To An Unauthorized Actor

Moodle is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to misconfiguration in a shared hosting environment, allowing a user with access to restore workshop modules and direct access to the web server outside of the Moodle webroot to execute a...

WordPress Database Cleaner Plugin <= 1.0.5 is vulnerable to Directory Traversal

Software Database Cleaner Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A5: Security Misconfiguration Classification Directory Traversal CVE CVE-2024-35712 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 5bd9ebec1e34 Credits Ananda Dhakal Patchstack...

WordPress Strategery Migrations Plugin <= 1.0 is vulnerable to Arbitrary File Download

Software Strategery Migrations Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Download CVE CVE-2024-35745 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 56c2660b4cfb Credits YCInfosec Required...

WordPress SC filechecker Plugin <= 0.6 is vulnerable to Arbitrary File Deletion

Software SC filechecker Type Plugin Vulnerable versions = 0.6 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-35743 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 308e99f1ec04 Credits YCInfosec Required privilege...

WordPress Upunzipper Plugin <= 1.0.0 is vulnerable to Arbitrary File Deletion

Software Upunzipper Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-35744 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 20a11d86aa33 Credits YCInfosec Required privilege...

Typo3 Security Misconfiguration in Frontend Session Handling

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...

GHSA-QR5F-6FCV-W69Q Typo3 Security Misconfiguration in Frontend Session Handling

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...

Typo3 Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

GHSA-G9RV-6G56-65H8 Typo3 Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

PT-2024-15474

Name of the Vulnerable Software and Affected Versions EMTA Grup PDKS versions before 20240603 Description The issue is related to an Improper Access Control vulnerability, allowing exploitation of incorrectly configured access control security levels. This vulnerability enables unauthorized acces...

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

CVE-2024-34005

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

CVE-2024-34003

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

CVE-2024-34005

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

CVE-2024-34003

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include...