5542 matches found
CVE-2024-37517
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7...
CVE-2024-37415
Missing Authorization vulnerability in E2Pdf.Com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through 1.20.27...
CVE-2024-37255
Missing Authorization vulnerability in Wpmet Elements kit Elementor addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elements kit Elementor addons: from n/a through 3.1.4...
CVE-2024-37204
Missing Authorization vulnerability in PropertyHive PropertyHive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through 2.0.9...
PT-2024-30450 · Unknown · Presto Player
Name of the Vulnerable Software and Affected Versions: Presto Player versions 3.0.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Presto Player versions...
WordPress Manage User Columns Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF)
Software Manage User Columns Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-51686 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6ea68c186a32 Credits thiennv...
PT-2024-9090 · Microsoft +1 · Windows +2
Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server version 8.8.1 Confluence Data Center and Server versions prior to 7.19.18 Confluence Data Center and Server versions prior to 8.5.5 Confluence Data Center and Server versions prior to 8.7.2 Confluence Data...
CVE-2024-50456
Missing Authorization vulnerability in The SEO Guys at SEOPress SEOPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through 8.1.1...
CVE-2024-6674
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...
CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...
CVE-2024-6674
CVE-2024-6674 involves a CORS misconfiguration in parisneo/lollms-webui prior to v10, exposing logs, browser sessions, API keys, and enabling actions on behalf of users (e.g., deleting a project or sending a message). Affected software: lollms-webui versions before 10. Root cause: misconfigured C...
CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...
CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...
LoLLMs 访问控制错误漏洞
LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An access control error vulnerability exists in LoLLMs versions prior to v10 that stems from the presence of a CORS configuration error that can be exploited by an attacker to steal sensitive...
PT-2024-37791 · Unknown · Lollms-Webui
Name of the Vulnerable Software and Affected Versions: lollms-webui versions prior to 10 Description: A CORS misconfiguration allows attackers to steal sensitive information, such as logs, browser sessions, and settings containing private API keys from other services. This issue can also enable...
tomcat: Denial of Service in Tomcat
A vulnerability was found in Tomcat. Under certain configurations on any platform, this flaw allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process...
Autolab 授权问题漏洞
Autolab is a course management service open-sourced by Autolab. It supports automatically graded programming assignments. An authorization issue vulnerability exists in Autolab version 3.0.0 that stems from a misconfiguration of the reset password permission...
PT-2024-23197 · Hcl · Hcl Sametime
Name of the Vulnerable Software and Affected Versions: HCL Sametime affected versions not specified Description: The issue is related to misconfigured security-related HTTP headers in HCL Sametime. Specifically, some HTTP headers are missing from web service responses, which can lead to less secu...
Zimbra Collaboration Server 代码问题漏洞
Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendar, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server ZCS, which stems from improper input cleanup and...
Security Bulletin: IBM Cognos Analytics Mobile (Android) is affected by multiple vulnerabilities
Summary There are vulnerabilities in Open Source Software OSS libraries consumed by IBM Cognos Analytics Mobile. These issues have been addressed by upgrading or removing the vulnerable libraries. Additionally, vulnerabilites related to CORS misconfiguration and Certificate Pinning have been...