CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284

CVE-2024-4284 affects mintplex-labs/anything-llm (versions prior to 1.0.0). The vulnerability allows a DoS by changing a user’s id to 0, enabling a manager/admin to render a target account inaccessible and cause uncontrolled resource consumption. Root cause: lack of input validation/sanitization ...

Session Fixation

laravel/framework is vulnerable to Session Fixation. The vulnerability is due to ineffective token validation allowing malicious users to maintain access even after the actual user's logout or password reset...

Exploit for Code Injection in Crushftp

Exploit Code for CVE-2024-4040 Overview This exploit code t...

PT-2024-25446 · Jegstudio · Jegstudio Financio

Name of the Vulnerable Software and Affected Versions: Jegstudio Financio versions 1.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Jegstudio Financio. This issue allows an attacker to perform unintended actions on a user's account. The estimated number of potentiall...

GHSA-7FPJ-9HR8-28VH Keycloak vulnerable to impersonation via logout token exchange

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-11925 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access...

keycloak: impersonation via logout token exchange

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-24393 · Seedprod · Seedprod Coming Soon Page

Name of the Vulnerable Software and Affected Versions: SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions through 6.15.20 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user int...

PT-2024-24284 · Etoile · Etoile Web Design Ultimate Product Catalogue

Name of the Vulnerable Software and Affected Versions: Etoile Web Design Ultimate Product Catalogue versions through 5.2.15 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions o...

PT-2024-24577 · Unknown · Awp Classifieds

Name of the Vulnerable Software and Affected Versions: AWP Classifieds versions n/a through 4.3.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that t...

PT-2024-24398 · Unknown · Nose Graze Novelist

Name of the Vulnerable Software and Affected Versions: Nose Graze Novelist versions through 1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that t...

PT-2024-24297 · Unknown · Live Composer

Name of the Vulnerable Software and Affected Versions: Page Builder: Live Composer versions 1.5.35 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-24063 · Favicon · Favicon

Name of the Vulnerable Software and Affected Versions: Favicon versions 1.3.29 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24300 · Userswp · Userswp

Name of the Vulnerable Software and Affected Versions: UsersWP versions prior to 1.2.6 Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

PT-2024-23471 · Unknown · Lws Optimize

Name of the Vulnerable Software and Affected Versions: LWS Optimize versions 1.9.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

BIT-ENVOY-2022-29226 Trivial authentication bypass in Envoy

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current...

PT-2024-14182 · Hasthemes · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HasThemes HT Mega – Absolute Addons For Elementor versions through 2.3.3 Description: A Cross-Site Request Forgery CSRF issue affects the specified software, allowing unauthorized actions to be performed on behalf of a user without their...

DEBIAN-CVE-2024-26594

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid...