CVE-2024-9302

CVE-2024-9302 affects the WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight, versions up to 5.3.7. The vulnerability enables privilege escalation/account takeover via weak OTP handling in verify_otp_forgot_password() and update_password(), allowing unauthenticated atta...

CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

CVE-2024-9109 UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deleteoauthdata function in all versions up to, and including, 2.3.12. This makes it possible for authenticated attackers,...

Admin account takeover due to allowed excessive guessing attempts for password reset code

This report is not public...

Admin user account takeover due to password reset code not being checked on the backend

This report is not public...

Autolab 授权问题漏洞

Autolab is a course management service open-sourced by Autolab. It supports automatically graded programming assignments. An authorization issue vulnerability exists in Autolab version 3.0.0 that stems from a misconfiguration of the reset password permission...

CVE-2024-48428

Technical details are not publicly available in the provided documents; monitor for updates on affected products/versions and remediation.

Olive VLE 安全漏洞

Olive VLE is a virtual learning environment from Olive that digitally transforms traditional lecture formats into high-end interactive learning experiences. A security vulnerability exists in Olive VLE that stems from allowing an attacker to gain access to sensitive information through the reset...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

CVE-2024-48428

An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function...

PT-2024-33490 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.0 Description: The issue concerns misconfigured reset password permissions for email-based accounts. Users with insufficient privileges could reset and potentially access privileged users' accounts by resetting their...

PT-2024-39557 · WordPress · The App Builder – Create Native Android & Ios Apps On The Flight

Name of the Vulnerable Software and Affected Versions: The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress versions up to, and including, 5.3.7 Description: The issue is related to privilege escalation via account takeover. This is due to the verify otp forgot...

PT-2024-33108 · Olive Vle · Olive Vle

Name of the Vulnerable Software and Affected Versions: Olive VLE affected versions not specified Description: An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function. Recommendations: At the moment, there is no information about a newer version tha...

Autolab Misconfigured Reset Password Permissions

For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords...

WordPress UPS Live Rates and Access Points plugin <= 2.3.11 - Missing Authorization to Plugin API key reset vulnerability

Missing Authorization to Plugin API key reset vulnerability discovered by Peter Thaleikis in WordPress Plugin WooCommerce UPS Shipping – Live Rates and Access Points versions = 2.3.11...

SUSE CVE-2024-49891

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths When the HBA is undergoing a reset or is handling an errata event, NULL ptr dereference crashes may occur in routines such as lpfcsliflushiorings,...

PT-2024-37035

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to RDMA/hns in the Linux kernel, where the CPU may get stuck due to numerous error messages during reset. When a large number of resources such as qp, cq, and mr are...

CVE-2024-20388

A vulnerability in the password change feature of Cisco Firepower Management Center FMC software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker coul...

CVE-2024-20388

A vulnerability in the password change feature of Cisco Firepower Management Center FMC software could allow an unauthenticated, remote attacker to determine valid user names on an affected device. This vulnerability is due to improper authentication of password update responses. An attacker coul...

PT-2024-7439 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC affected versions not specified Description: The issue is related to errors in processing requests in the password change feature of the Cisco Firepower Management Center FMC software. This could allow a...