The vulnerability of the missingobjects.php script in the Nagios XI monitoring tool allows a hacker to modify the CCM settings and clear the “Missing Objects” list.

The vulnerability of the missingobjects.php script in the Nagios XI monitoring tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to modify the CCM settings and remove items from the “Missing Objects” list...

CVE-2023-38885

OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery CSRF protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing request...

CVE-2023-38544

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

CVE-2023-38544

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

Default configuration

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

CVE-2023-38544

CVE-2023-38544 affects Ivanti (Secure Access Client) on Linux. A logged-in user can modify specific files, potentially enabling unauthorized changes to system-wide configuration settings, compromising integrity. Root cause: exploitation locally by a user with low privileges; impact listed as part...

CVE-2023-38544

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

CVE-2023-38544

A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited to compromise the integrity and security of the network on the affected system...

Elenos ETG150 Security Vulnerability

The Elenos ETG150 is an FM transmitter from Elenos. A security vulnerability exists in the Elenos ETG150 FM Transmitter version v3.12, which stems from an insufficient session expiration time and allows an attacker to arbitrarily change configuration and data after logging out...

PT-2023-27279 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: A permission bypass issue in the ApnEditor.java file allows a Guest user to change the APN, potentially leading to local escalation of privilege without requiring additional execution...

CVE-2023-43634

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. I...

PT-2023-28007 · O Ran Software Community · Ric-Plt-Lib-Rmr

Name of the Vulnerable Software and Affected Versions: O-RAN Software Community ric-plt-lib-rmr version 4.9.0 Description: The issue is related to the lack of validation of the source of routing tables received by the device, potentially allowing attackers to send forged routing tables. This coul...

CVE-2023-2353

The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chpabdaction function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin...

PT-2023-19014 · WordPress · Chp Ads Block Detector

Name of the Vulnerable Software and Affected Versions: CHP Ads Block Detector plugin for WordPress versions up to, and including, 3.9.4 Description: The issue allows unauthorized updates and resets of plugin settings due to a missing capability check on the chp abd action function. This enables...

CVE-2023-4276 Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Change

The Absolute Privacy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1. This is due to missing nonce validation on the 'abprprofileShortcode' function. This makes it possible for unauthenticated attackers to change user email and password via a...

Anyone can call the perform function because there is no access control

Lines of code L31-L75 Vulnerability details Impact Anyone can call the perform function. It can lead to unauthorized changes in the security council. Proof of Concept There is no access control in the perform function and it is marked "external". function performaddress securityCouncil, address...

PT-2023-22883 · Telecom · Telecom

Name of the Vulnerable Software and Affected Versions: Telecom versions prior to SMR Aug-2023 Release 1 Description: The issue is related to improper access control, allowing local attackers to change TTY mode. This could potentially lead to unauthorized system modifications. Recommendations: For...

How Qualys Drives PCI DSS 4.0 Compliance for File Integrity Monitoring

The Payment Card Industry Data Security Standard PCI DSS is a well-known rule for compliance by merchants and entities involved in payment card processing. The new PCI DSS 4.0 standard specifies a broad range of technical and process requirements to ensure the safety of payment cardholder data or...

CVE-2022-42175

Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization...

PT-2023-14067 · Solusvm +1 · Solusvm +1

Name of the Vulnerable Software and Affected Versions: WHMCS module SolusVM version 1.4.1.2 Description: The issue allows an attacker to change the password and hostname of other customer servers without authorization due to an Insecure Direct Object Reference vulnerability. Recommendations: For...