New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Vvveb CMS: Insecure direct object reference in admin API token management

Vvveb is a content management system with a page builder. In versions before 1.0.8.7, the admin/auth-token endpoint does not check whether the requested admin_id belongs to the logged-in administrator. An authenticated administrator can therefore read and overwrite the API tokens of other administrators, even without the capability to manage other admin users. A stolen token can be used to access the REST API with the victim's permissions.

givanz · Vvveb

Research and translation in progress – available shortly.

Vvveb: Authentication bypass in password reset allows account takeover

Vvveb is a CMS with a page builder for websites, blogs and web shops. Versions before 1.0.8.7 do not properly validate the user and token GET parameters in the password reset function. According to the GitHub advisory, an attacker can supply PHP array parameters instead of strings to bypass the check, reset the password of arbitrary users and take over their accounts, including administrator accounts. No login or user interaction is required.

givanz · Vvveb

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Dell OpenManage Enterprise: OS command injection allows command execution

Dell OpenManage Enterprise (OME), Dell's central console for managing Dell servers and hardware, contains an OS command injection flaw (CWE-78) in versions prior to 4.8.0. An attacker with remote access and a low-privileged account can inject operating system commands and execute them on the appliance, with high impact on confidentiality, integrity and availability. The CVSS 3.1 score from the CNA is 8.8; VulDB lists 9.9, so the vendor score should be used for prioritisation.

Dell · OpenManage Enterprise

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

AIDotNet OpenDeepWiki: Hard-coded JWT signing key allows admin token forgery

OpenDeepWiki through 2.0.6 uses a JWT signing key that is hard-coded in appsettings.json (Jwt:SecretKey) and publicly visible in the source code. An unauthenticated remote attacker can sign HS256 tokens with an Admin role claim and use them against /api/admin endpoints. This allows control over users, roles, repositories, settings and stored API keys. The attack requires only network access to the instance and knowledge of the public key.

AIDotNet · OpenDeepWiki

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.