4056 matches found
Authorization
An Authorization Bypass Through User-Controlled Key vulnerability CWE-639 affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other...
CVE-2023-48783
An Authorization Bypass Through User-Controlled Key vulnerability CWE-639 affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other...
CVE-2023-48783
CVE-2023-48783 affects PortiPortal versions 7.2.1 and below, 7.0.6 and below, 6.0.14 and below, and 5.3.8 and below. It describes an Authorization Bypass Through User-Controlled Key that could allow a remote authenticated user with at least read-only permissions to access endpoints of other organ...
CVE-2024-21738 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform
SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...
CVE-2023-51502
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1...
Authorization
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1...
PT-2024-14160
Name of the Vulnerable Software and Affected Versions WooCommerce Stripe Payment Gateway versions through 7.6.1 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Stripe Payment Gateway. Recommendations For versions through 7.6.1,...
CVE-2023-51502: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1...
LearnPress < 4.2.5.8 - Subscriber+ Arbitrary Course Progress Disclosure
Description The plugin is vulnerable to Insecure Direct Object Reference in the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the...
WP 2FA < 2.6.0 - Subscriber+ Arbitrary Email Sending
Description The plugin is vulnerable to Insecure Direct Object Reference via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site...
CVE-2023-51503
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...
CVE-2023-51503
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...
Authorization
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...
CVE-2023-51503
CVE-2023-51503 relates to WooPayments (Automattic Woo) and is described as an unauthenticated Authorization Bypass via a user-controlled key. The vulnerability affects WooPayments up to 6.9.2 and is characterized as an insecure direct object reference, enabling bypass of authorization controls. T...
CVE-2023-51503: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...
ewen-lbh/ffcss Late-Unicode normalization vulnerability
Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...
GHSA-WPMX-564X-H2MH ewen-lbh/ffcss Late-Unicode normalization vulnerability
Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...
EuroTel ETL3100 Authentication Bypass
The vulnerability of the microprogramming software of EuroTel ETL3100 and EuroTel ETL3100RT lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker, operating remotely, to circumvent security restrictions, gain unauthorized...