| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
| The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying. |
| The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account. |
| The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals. |
| The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services. |
| Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. |
| Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. |
| Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. |
| Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
| Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. |
| Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. |
| Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. |
| Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network. |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network. |
| '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. |
| Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. |
| Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
| Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network. |
| Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. |
