780 matches found
CVE-2024-0204
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal...
Authentication flaw
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal...
CVE-2024-0204 Authentication Bypass in GoAnywhere MFT
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal...
CVE-2024-23329 changedetection.io API endpoint is not secured with API token
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch//history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party...
Improper Authorization
pimcore/ecommerce-framework-bundle is vulnerable to Improper Authorization. The vulnerability is due to a lack of permission enforcement within the admin/ecommerceframework/admin-order/list endpoint. An unauthorized user can access this endpoint without authorization, resulting in the ability to...
CVE-2024-21665
ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in...
Code injection
The Customer Management Framework CMF for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Permissions are enforced when...
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
Summary An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/gdpr-data/search-data-objects...
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
Summary An authenticated and unauthorized user can access the list of potential duplicate users and see their data. Details Permissions do not seem to be enforced when reaching the /admin/customermanagementframework/duplicates/list endpoint allowing an authenticated user without the permissions t...
GitLab 12.10 < 14.6.5 / 14.7 < 14.7.4 / 14.8 < 14.8.2 (CVE-2022-0735)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An...
GitLab 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22239)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. CVE-2021-22239 Note that Nessus has not tested for this issue but has instead relied only on th...
Improper Access Control
gitlab:sid is vulnerable of improper access control. The vulnerability due to improper permission validation and fails to authorization check. It leads to allow an attacker to edit labels description by an unauthorized user...
CVE-2023-5906
The Job Manager & Career WordPress plugin before 1.4.4 contains a vulnerability in the Directory Listings system, which allows an unauthorized user to view and download private files of other users. This vulnerability poses a serious security threat because it allows an attacker to gain access to...
Exploit for CVE-2023-38646
CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase ope...
CVE-2023-41808
Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773...
CVE-2023-41808 Arbitrary File Read As Root Via GoTTY Page
Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773...
CVE-2023-4804
CVE-2023-4804 affects Johnson Controls Quantum HD Unity family. The root cause is an active debug code/debug features accidentally exposed, allowing an unauthorized user to access debugging functionality. Affected products and versions include: Quantum HD Unity Compressor panels (Q5: all versions...
CVE-2023-4804 Quantum HD Unity
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed...
CVE-2023-3399 Insertion of Sensitive Information Into Sent Data in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom...