Attacker can frontrun calling _mint_to_Accountant() which mints the entire supply to the caller, and sets them as _accountant and admin

Lines of code Vulnerability details Impact By leaving minttoAccountant with no access control when accountant = address0 it allows an attacker to call the function, mint the entire supply to themselves, and gain the accountant and admin roles. Additionally, the parameter "address...

CVE-2022-29452

Authenticated editor or higher user role Stored Cross-Site Scripting XSS vulnerability in Export All URLs plugin = 4.1 at WordPress...

CVE-2022-28612

Improper Access Control vulnerability leading to multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Muneeb's Custom Popup Builder plugin = 1.3.1 at WordPress...

CVE-2022-29443

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Nicdark's Hotel Booking plugin = 3.0 at WordPress...

CVE-2022-29438

Authenticated author or higher user role Persistent Cross-Site Scripting XSS vulnerability in Image Slider by NextCode plugin = 1.1.2 at WordPress...

CVE-2022-29440

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Promotion Slider plugin = 3.3.4 at WordPress...

CVE-2022-29440 WordPress Promotion Slider plugin <= 3.3.4 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Promotion Slider plugin = 3.3.4 at WordPress...

Money Transfer Management System Elevation of Privilege Vulnerability

Money Transfer Management System is a remittance management system.An elevation of privilege vulnerability exists in Money Transfer Management System version 1.0. A remote attacker can exploit this vulnerability to gain elevated privileges to the Admin role via any URL...

PT-2022-21177 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.1 Description: A missing authentication verification for a resource used to change the roles and permissions of a user has been identified. This could allow an attacker to change the permissio...

CVE-2022-32562

An issue was discovered in Couchbase Server before 7.0.4. Operations may succeed on a collection using stale RBAC permission...

CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

Code injection

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

CVE-2022-32560

An issue was discovered in Couchbase Server before 7.0.4. XDCR lacks role checking when changing internal settings...

CVE-2022-1658

Vulnerable versions of the Jupiter Theme = 6.10.1 allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abbremoveplugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, an...

Couchbase Server 授权问题漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. A security vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from a lack of role checki...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL...

CVE-2021-44582

CVE-2021-44582 affects Sourcecodester Money Transfer Management System 1.0. A remote attacker can escalate privileges to Admin via any URL. Documents cite network-based, low-attack-complexity access with single authentication and high impact (confidentiality, integrity, availability) per CVSS v3....