CWE:

	Tytuł	Data	Autor
Med.	FleetCart 4.1.1 Information Disclosure	28.05.2024	CraCkEr
Low	PlayTube 3.0.1 Information Disclosure	05.09.2023	CraCkEr
High	HanYazilim Paper Submission System .NET 1.0 Shell Upload	25.02.2019	KingSkrupellos
Med.	HanYazilim Paper Submission System .NET v1.0 Privilege Escalation / Backdoor Access	22.02.2019	KingSkrupellos
Low	Calamp.com Incorrect Privilege Assignment	15.05.2018	Vangelis Stykas

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-10-20

CVE-2024-49608

Updating...

: Incorrect Privilege Assignment vulnerability in Gerry Ntabuhashe GERRYWORKS Post by Mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through 1.0.

2024-10-17

	CVE-2024-49217	Updating...	Incorrect Privilege Assignment vulnerability in Madiri Salman Aashish Adding drop down roles in registration allows Privilege Escalation.This issue affects Adding drop down roles in registration: from n/a through 1.1.
	CVE-2024-49219	Updating...	Incorrect Privilege Assignment vulnerability in themexpo RS-Members allows Privilege Escalation.This issue affects RS-Members: from n/a through 1.0.3.
	CVE-2024-49322	Updating...	Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through 1.0.
	CVE-2024-9863	Updating...	The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.

2024-10-10

CVE-2024-9519

Updating...

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'save_metabox_form' function in versions up to, and including, 2.0. This makes it possible for authenticated attackers, with editor-level permissions or above, to update the registration form role to administrator, which leads to privilege escalation.

2024-10-04

CVE-2024-47653

Updating...

This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to unauthorized modification of requests belonging to the other users.

2024-10-01

CVE-2024-25632

Updating...

eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and a regular user in another. The vulnerability allows a regular user to become administrator of a team where they are a member, under a reasonable configuration. Additionally, in eLabFTW versions subsequent to v5.0.0, the vulnerability may allow an initially unauthenticated user to gain administrative privileges over an arbitrary team. The vulnerability does not affect system administrator status. Users should upgrade to version 5.1.0. System administrators are advised to turn off local user registration, saml_team_create and not allow administrators to import users into teams, unless strictly required.

2024-09-17

	CVE-2024-22303	Updating...	Incorrect Privilege Assignment vulnerability in favethemes Houzez houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4.
	CVE-2024-21743	Updating...	Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.

 

---

Copyright 2024, cxsecurity.com