CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity expiry, not-before, issuance date, which can allow an attacker to bypass the check for token expiration. The issue requires to have ...

CVE-2024-8642 Eclipse EDC: Consumer pull transfer token validation checks not applied

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity expiry, not-before, issuance date, which can allow an attacker to bypass the check for token expiration. The issue requires to have ...

PT-2024-30166 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: A Cross-Site Request Forgery CSRF issue was found in the system. This can be exploited through a crafted request to the "/music/ajax.php?action=save user" page. Recommendations: For...

PT-2024-7880 · Siemens · Industrial Edge Management Virtual +1

Name of the Vulnerable Software and Affected Versions: Industrial Edge Management Pro versions prior to V1.9.5 Industrial Edge Management Virtual versions prior to V2.3.1-1 Description: A vulnerability has been identified in the affected components of Industrial Edge Management, which do not...

CVE-2024-39063

Lime Survey = 6.5.12 is vulnerable to Cross Site Request Forgery CSRF. The YIICSRFTOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests...

Insufficient Session Expiration

zfr/zfr-oauth2-server-module is vulnerable to Insufficient Session Expiration. The vulnerability is due to a lack of token validation for expiration and validity, allowing users to potentially use invalidated authentication credentials...

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...

CVE-2024-4284

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284 Denial of Service in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm allows for a denial of service DoS condition through the modification of a user's id attribute to a value of 0. This issue affects the current version of the software, with the latest commit id 57984fa85c31988b2eff429adfc654c46e0c342a. By exploiting...

CVE-2024-4284

CVE-2024-4284 affects mintplex-labs/anything-llm (versions prior to 1.0.0). The vulnerability allows a DoS by changing a user’s id to 0, enabling a manager/admin to render a target account inaccessible and cause uncontrolled resource consumption. Root cause: lack of input validation/sanitization ...

Session Fixation

laravel/framework is vulnerable to Session Fixation. The vulnerability is due to ineffective token validation allowing malicious users to maintain access even after the actual user's logout or password reset...

Exploit for Code Injection in Crushftp

Exploit Code for CVE-2024-4040 Overview This exploit code t...

PT-2024-25446 · Jegstudio · Jegstudio Financio

Name of the Vulnerable Software and Affected Versions: Jegstudio Financio versions 1.1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Jegstudio Financio. This issue allows an attacker to perform unintended actions on a user's account. The estimated number of potentiall...

GHSA-7FPJ-9HR8-28VH Keycloak vulnerable to impersonation via logout token exchange

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-11925 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access...

keycloak: impersonation via logout token exchange

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

PT-2024-24297 · Unknown · Live Composer

Name of the Vulnerable Software and Affected Versions: Page Builder: Live Composer versions 1.5.35 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-24063 · Favicon · Favicon

Name of the Vulnerable Software and Affected Versions: Favicon versions 1.3.29 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...

PT-2024-24398 · Unknown · Nose Graze Novelist

Name of the Vulnerable Software and Affected Versions: Nose Graze Novelist versions through 1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that t...