8471 matches found
CVE-2020-35934
The WordPress Advanced Access Manager plugin (AAM) prior to version 6.6.2 discloses the unfiltered user object (including all metadata) upon login via REST API endpoints aam/v1/authenticate and aam/v2/authenticate. This exposes user data that may include custom metadata from other plugins, creati...
CVE-2020-35934
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...
CVE-2020-35934
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...
CVE-2020-35934: Exposure of Sensitive Information to an Unauthorized Actor
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...
CVE-2020-26033
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
CVE-2020-26033
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
CVE-2020-29160
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...
Cross site request forgery (csrf)
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
Design/Logic Flaw
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...
CVE-2020-26033
CVE-2020-26033 affects Zammad prior to version 3.4.1, where the Tag and Link REST API endpoints (add and delete) do not perform CSRF token validation. Connected sources corroborate a CSRF vulnerability in the labeling/linking REST paths, with broader references noting fixes in newer releases (e.g...
CVE-2020-26033
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
CVE-2020-26033
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
CVE-2020-29160
CVE-2020-29160 affects Zammad before 3.5.1. A REST API call can modify Ticket Article data and defeat auditing via an access-control flaw, with no authentication required in CVSS terms. Impact is integrity loss (high) and auditing bypass. Remediation stated across sources is to upgrade to Zammad ...
CVE-2020-29160
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...
CVE-2020-29160
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...
CVE-2020-26033: Cross-Site Request Forgery (CSRF)
An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints for add and delete lack a CSRF token check...
CVE-2020-29160: Missing Authorization
An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...
PT-2020-17104
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.5.1 Description An issue was discovered that allows an attacker to change Ticket Article data in a way that defeats auditing through a REST API call. Recommendations For versions prior to 3.5.1, update to version 3.5...
PT-2020-16270
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1 Description An issue was discovered in the Tag and Link REST API endpoints for add and delete operations, which lack a CSRF token check. The "Tag and Link REST API endpoints" are affected, specifically the...
