5120 matches found
CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)
omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...
Omniauth::MicrosoftGraph License Issues Vulnerability
Omniauth::MicrosoftGraph is an Omniauth policy for the Microsoft Graph Api from the individual developer Peter Philips. An authorization issue vulnerability exists in versions of Omniauth::MicrosoftGraph prior to 2.0.0, which stems from a failure to validate the legitimacy of a user's email...
WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.2 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-52136 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5f069383b9f0 Credit...
WordPress Rate my Post – WP Rating System Plugin <= 3.4.2 is vulnerable to Broken Access Control
Software Rate my Post – WP Rating System Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Security Misconfiguration Classification Broken Access Control CVE CVE-2023-51667 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 327f1bb4bf15 Credits Brandon...
WordPress Backup Migration Plugin 1.0.8-1.3.9 is vulnerable to Remote File Inclusion
Software Backup Migration Type Plugin Vulnerable versions 1.0.8-1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Remote File Inclusion CVE CVE-2023-6971 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e70590c9be58 Credits NP3228 - NFlabs...
WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)
Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.20 Fixed in 6.21 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-51696 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...
WordPress Backup Migration Plugin <= 1.3.9 is vulnerable to Path Traversal
Software Backup Migration Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6972 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 63ca4651f92b Credits NP3228 Required privilege...
WordPress Branda Plugin <= 3.4.14 is vulnerable to Bypass Vulnerability
Software Branda Type Plugin Vulnerable versions = 3.4.14 Fixed in 3.4.15 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-51542 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID 6298c3f8ebb2 Credits Brandon Roldan Required privilege...
CVE-2023-50928 sandbox-accounts-for-events security misconfiguration leads to budget exceed
"Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event...
CVE-2023-49792 Bruteforce protection can be bypassed with misconfigured proxy
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a reverse proxy is configured as truste...
UPM : User profile do not load on VDI or Application launch
User profile does not load on logon andCitrix User Profile Management logs following error. UserIsMemberOfGroup: Group name was not found! Please correct the misconfiguration...
Data Leak Exposes 1.5 Billion Real Estate Records, Including Elon Musk, Kylie Jenner
By Waqas A Campbell, New York-based real estate training platform called Real Estate Wealth Network exposed a massive treasure trove of real estate records due to cloud server misconfiguration. This is a post from HackRead.com Read the original post: Data Leak Exposes 1.5 Billion Real Estate...
WordPress Bit File Manager Plugin < 6.3 is vulnerable to Path Traversal
Software Bit File Manager Type Plugin Vulnerable versions 6.3 Fixed in 6.3 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-5907 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID f6d18601e62a Credits Dmitrii Ignatyev Required privilege...
TotalCloud Insights: Hidden Risks of Amazon S3 Misconfigurations
Misconfiguring Amazon S3 Buckets Can Pose Major Risks Amazon Web Services AWS is the world’s largest cloud security provider, and it provides the ability to store massive amounts of cloud-resident data with the Amazon Simple Storage Service S3 bucket. Amazon S3 is an object storage solution known...
SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.
Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but d...
GHSA-8QP8-9RPW-J46C SMTP misconfiguration leading to "Forgot Password" exploit that leaks registered user email.
Impact A user enumeration attack is possible when SMTP is not setup correctly, but reset password is enabled Explanation of the vulnerability Two different error messages was shown, based on if the user exists or not when using the forgot password functionality, when the SMTP was configured but d...
CVE-2023-47579
Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system...
CVE-2023-47579
Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system...
