CWE:

	Tytuł	Data	Autor
Med.	OX Documents 7.10.5 Improper Authorization	21.07.2021	Martin Heiland
Med.	CTFd 2.1.5 Administrator Account Takeover	04.01.2020	Social Engineering Neo
Med.	Microsoft Windows Task Scheduler Local Privilege Escalation	22.07.2019	Social Engineering Neo
Med.	Slims CMS Akasia 8.3.1 SQL Injection	22.05.2019	KingSkrupellos
Med.	Slims CMS Akasia 8.3.1 Improper Authorization Vulnerability	19.05.2019	KingSkrupellos
Med.	Dell OpenManage Network Manager 6.2.0.51 SP3 Privilege Escalation	07.11.2018	Matthew Bergin
Low	SAP Business Objects Unauthorized Audit Information Access	26.02.2015	Onapsis
Med.	SAP Business Objects Unauthorized Audit Information Delete	26.02.2015	Onapsis
Low	SAP Business Objects Information Disclosure Via CORBA	09.10.2014	Will Vandevanter
Med.	SAP Business Warehouse Missing Authorization Check	09.10.2014	Will Vandevanter
Med.	SAP Business Objects Denial Of Service Via CORBA	09.10.2014	Will Vandevanter
Med.	Checkpoint Endpoint Security Media Encryption EPM Explorer Bypass	15.11.2013	Pedro Andujar
High	Zoom Telephonics Multiple Vulns	03.09.2013	K Lovett

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-10-16

CVE-2020-36841

Updating...

The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommerce_coupon_admin_init function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates of any value, which could be redeemed for products sold on the victim�??s storefront.

2024-10-15

CVE-2024-47876

Updating...

Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability.

2024-10-10

	CVE-2024-45132	Updating...	Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect confidentiality. Exploitation of this issue does not require user interaction.
	CVE-2024-45131	Updating...	Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on confidentiality and integrity. Exploitation of this issue does not require user interaction.
	CVE-2024-45128	Updating...	Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and have a low impact on integrity and availability. Exploitation of this issue does not require user interaction.
	CVE-2024-47165	Updating...	Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to **CORS origin validation accepting a null origin**. When a Gradio server is deployed locally, the `localhost_aliases` variable includes "null" as a valid origin. This allows attackers to make unauthorized requests from sandboxed iframes or other sources with a null origin, potentially leading to data theft, such as user authentication tokens or uploaded files. This impacts users running Gradio locally, especially those using basic authentication. Users are advised to upgrade to `gradio>=5.0` to address this issue. As a workaround, users can manually modify the `localhost_aliases` list in their local Gradio deployment to exclude "null" as a valid origin. By removing this value, the Gradio server will no longer accept requests from sandboxed iframes or sources with a null origin, mitigating the potential for exploitation.
	CVE-2024-47084	Updating...	Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker�??s website to make unauthorized requests to a local Gradio server. Potentially, attackers can upload files, steal authentication tokens, and access user data if the victim visits a malicious website while logged into Gradio. This impacts users who have deployed Gradio locally and use basic authentication. Users are advised to upgrade to `gradio>4.44` to address this issue. As a workaround, users can manually enforce stricter CORS origin validation by modifying the `CustomCORSMiddleware` class in their local Gradio server code. Specifically, they can bypass the condition that skips CORS validation for requests containing cookies to prevent potential exploitation.

2024-10-04

CVE-2024-47183

Updating...

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

2024-09-28

CVE-2024-9297

Updating...

A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument page with the input trains/schedules/system_info leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

2024-09-22

CVE-2024-9082

Updating...

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the argument type with the input 1 leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

 

---

Copyright 2024, cxsecurity.com