CVE-2024-42464

Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42464

CVE-2024-42464 affects upKeeper Manager (upKeeper) up to version 5.1.9. The issue is an Authorization Bypass Through User-Controlled Key, where REST’s trust in the system resource can be abused to obtain sensitive data. The root cause is described as an authorization bypass via a user-controlled ...

CVE-2024-42464 Leak of user information

Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42463 Leak of organizations messages

Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9...

CVE-2024-42463

The connected documents provide concrete details for CVE-2024-42463: in upKeeper Manager, versions through 5.1.9 are affected by an Authorization Bypass via a user-controlled key that abuses REST’s trust in system resources to obtain sensitive data. Practical impact is unauthorized access to sens...

PT-2024-29959 · Unknown · Upkeeper Manager

Name of the Vulnerable Software and Affected Versions: upKeeper Manager versions through 5.1.9 Description: The issue allows unauthorized access to sensitive data by exploiting REST's trust in system resources through a user-controlled key. This can lead to an authorization bypass, enabling threa...

PT-2024-29960 · Unknown · Upkeeper Manager

Name of the Vulnerable Software and Affected Versions: upKeeper Manager versions through 5.1.9 Description: An Authorization Bypass Through User-Controlled Key issue exists in upKeeper Manager, allowing an attacker to utilize REST's trust in the system resource to obtain sensitive data...

The vulnerability of the administration interface of the Fortinet FortiPortal security analysis and management tool allows a perpetrator to expose the protected information.

The vulnerability of the administration interface of the Fortinet FortiPortal security analysis and management tool involves bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending specially crafted HTT...

CVE-2024-39642

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LearnPress: from n/a through 4.2.6.8.2...

CVE-2024-39642

CVE-2024-39642 is an Insecure Direct Object References (IDOR) vulnerability in the LearnPress WordPress LMS plugin (versions up to 4.2.6.8.2). The root cause is an Authorization Bypass where a user-controlled key allows accessing functionality not properly constrained by ACLs. Public disclosures ...

PT-2024-28579 · Thimpress · Learnpress

Name of the Vulnerable Software and Affected Versions: ThimPress LearnPress versions through 4.2.6.8.2 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: Fo...

GHSA-5FWQ-9X7J-2QPG lorawan-stack Open Redirect vulnerability

lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume th...

CVE-2024-38701

Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4...

PT-2024-28145 · Unknown · Academy Lms

Name of the Vulnerable Software and Affected Versions: Academy LMS versions n/a through 2.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Academy LMS. Recommendations: For versions n/a through 2.0.4, at the moment, there is no...

CVE-2024-5977

CVE-2024-5977 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. The vulnerability is an Insecure Direct Object Reference (IDOR) in the handleRequest path, with missing validation on a user-controlled key, enabling authenticated users with GiveWP Worker-level access and abov...

CVE-2024-5619

Authorization Bypass Through User-Controlled Key vulnerability in PruvaSoft Informatics Apinizer Management Console allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Apinizer Management Console: before 2024.05.1...

PT-2024-36734 · Unknown · Apinizer Management Console

Name of the Vulnerable Software and Affected Versions: Apinizer Management Console versions prior to 2024.05.1 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in the Apinizer Management Console. This vulnerability allows exploitation due to...

Remote Code Execution (RCE)

torrentpier/torrentpier is vulnerable to Remote Code Execution RCE. The vulnerability is due to the unsafe handling of user-controlled data specifically cookies within the gettracks function in torrentpier/library/includes/functions.php, where unsafe usage of PHP's native serialization format...

CVE-2024-40624

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...