Combodo iTop 访问控制错误漏洞

Combodo iTop is a suite of open source web applications developed by Combodo France based on ITIL and used for the day-to-day operation of IT environments. The program provides incident management, configuration management, and problem management functionality. An Access Control Error vulnerabili...

Kashipara Bus Ticket Reservation System 安全漏洞

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. An access control error vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which can be exploited by attackers to cause unauthorized operation...

Kashipara Hotel Management System 安全漏洞

Kashipara Hotel Management System is a hotel management system from Kashipara. An access control error vulnerability exists in Kashipara Hotel Management System v1.0 that can be exploited by an attacker to cause unauthorized operation...

SAP Document Builder Authorization Issues Vulnerability

SAP Document Builder is a content-driven cross-application solution from SAP. An authorization issue vulnerability exists in SAP Document Builder that stems from not performing required authorization checks for certain modules. An attacker could exploit the vulnerability to cause unauthorized...

IBM Aspera Orchestrator Cross-Site Request Forgery Vulnerability

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide data-driven organizations with an efficient document processing pipeline. A cross-site request forgery vulnerability exists in IBM Aspera Orchestrator version 4.0.1. An attacker could...

CVE-2024-27782

Multiple insufficient session expiration weaknesses CWE-613 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests...

CVE-2024-27782

Multiple insufficient session expiration weaknesses CWE-613 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests...

CVE-2024-27782

Fortinet FortiAIOps 2.0.0 is affected by CVE-2024-27782 due to insufficient session expiration, enabling an attacker to reuse stolen session tokens to perform unauthorized operations via crafted requests. Affected component: FortiAIOps (Fortinet). Root cause: multiple sessions with insufficient e...

CVE-2024-27782

Multiple insufficient session expiration weaknesses CWE-613 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests...

PT-2024-31349 · Lollms +1 · Lollms +2

Name of the Vulnerable Software and Affected Versions: lollms version 9.6 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server due to a lax CORS policy, allowing attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage. This...

CVE-2024-23665

Multiple improper authorization vulnerabilities CWE-285 in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and below, version 6.4.3 and below, version 6.3.23 and below may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests...

Mass Assignment

Laravel is vulnerable to Mass Assignment. The vulnerability is due to insufficient column quoting for all database drivers, which could allow attackers to perform unauthorized mass assignment operations. If using guarded and passing a user-controlled array into an "update" or "save" function,...

CVE-2024-23576

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2024-23576 HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2024-23576

The vulnerability (CVE-2024-23576) affects HCL Commerce versions 9.1.12 and 9.1.13. The issue can lead to denial of service, disclosure of user personal data, and execution of unauthorized administrative operations. The provided documents do not include concrete exploit details, vectors, or offic...

CVE-2024-31406

Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with access to the device may perform unauthorized operations...

CVE-2024-31406

RoamWiFi R10 firmware before 4.8.45 contains an Active debug code vulnerability (CWE-489). A network-adjacent, unauthenticated attacker with access to the device can perform unauthorized operations. Affected products are RoamWiFi R10 versions prior to 4.8.45; remediation is to update to 4.8.45 or...

CVE-2024-31406

Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with access to the device may perform unauthorized operations...

CVE-2024-31406

Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network-adjacent unauthenticated attacker with access to the device may perform unauthorized operations...

RoamWiFi R10 安全漏洞

RoamWiFi R10 is a portable Internet wireless router from RoamWiFi. A security vulnerability exists in RoamWiFi R10 versions prior to 4.8.45 that originates from a vulnerability that allows an attacker to perform unauthorized operations...