Group Member Handler Component Unauthorized Access

The vulnerability of the Group Member Handler component in the Git-based software platform for collaborative code development on GitLab relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

Command Injection

cups-filters is vulnerable to Command Injection. Any value passed to FoomaticRIPCommandLine via a PPD file will be executed as a user controlled command. When combined with other logic bugs as described in CVE2024-47176, this can lead to remote command execution...

RHEL OpenPrinting cups-filters (RHSB-2024:002)

Binary data redhat-RHSB-2024-002.nbin...

CVE-2024-47175

CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can...

CVE-2024-47175

CVE-2024-47175 affects CUPS via libppd, where ppdCreatePPDFromIPP2 does not sanitize IPP attributes when building the PPD buffer. When used with functions such as cfGetPrinterAttributes5, attacker-controlled input can lead to code execution through Foomatic, contributing to an exploit chain descr...

CVE-2024-47175 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can...

Authorization Bypass Through User-Controlled Key

Overview aimeos/ai-controller-frontend is an Aimeos business controller logic for frontend Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the account profile page. An attacker can manipulate account details and disable subscriptions an...

CVE-2024-8290

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFMCustomersManageController::processing function due to missing validation...

CVE-2024-7491 HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woofmessengerremovesubscr AJAX action due to missing validation on the 'key' user controlled key. This makes it...

kernel: vmci: prevent speculation leaks by sanitizing event in event_deliver()

A vulnerability was found in the eventdeliver function in the Linux kernel's VMCI component, where the issue involves a lack of sanitization for the eventdata.event index controlled by user-space, which could lead to speculative information leaks...

CVE-2024-47069

Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...

CVE-2024-6685 Authorization Bypass Through User-Controlled Key in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members...

CVE-2024-3305

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

CVE-2024-3306

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

CVE-2024-3305

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

CVE-2024-3306

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

CVE-2024-3306

This CVE-2024-3306 entry concerns Utarit Information SoliClub. Affected software: SoliClub mobile app on iOS (versions before 4.4.0) and Android (versions before 5.2.1). Vulnerability: Authorization Bypass Through User-Controlled Key due to incorrectly configured access control security levels. I...

CVE-2024-3306 IDOR in Utarit Information's SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

CVE-2024-3306 IDOR in Utarit Information's SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android...

PT-2024-25099 · Utarit Information · Utarit Information Soliclub

Name of the Vulnerable Software and Affected Versions: Utarit Information SoliClub versions prior to 4.4.0 for iOS Utarit Information SoliClub versions prior to 5.2.1 for Android Description: The issue affects Utarit Information SoliClub, allowing exploitation of incorrectly configured access...