James Golovich

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.

The Metasploit Framework Web Service REST API (msf-ws) contains a flaw where the `Msf::WebServices::CredentialServlet` fails to enforce authentication for specific routes. Specifically, the `update credential` (PUT) and `delete credentials` (DELETE) handlers for the '/api/v1/credentials' endpoint omit the required authentication call. Since the underlying `lib/ms/core/db manager/cred.rb` does not perform its own authorization checks, any client with network access to the default 0.0.0.0:8080 listener can read, modify, or permanently delete all stored credential records, including passwords, hashes, and private keys.

The issue allows sensitive data to be exposed in logs, which an attacker could use to find hashed passwords and possibly escalate their privilege.

The issue allows unauthenticated users to upload files, limited to those allowed in a default WordPress configuration, if a frontend form is available. This was introduced in the 5.0 rewrite and did not exist prior to that release.

The issue allows for privilege escalation.

The issue is related to incorrect access control for admin init settings changes in the wp-invoice plugin.

The issue is related to incorrect access control, specifically over updates to payer metadata for PayPal in the wp-invoice plugin.

The issue is related to incorrect access control over updates to payer metadata for the wpi interkassa module.

The issue is related to incorrect access control over updates to payer metadata for the wpi twocheckout component.

The issue allows for privilege escalation due to the wpi update user option.

The issue is related to incorrect access control in the wp-invoice plugin, specifically over the `wpi user id` variable for invoice retrieval.

The issue is related to incorrect access control for shortcodes due to a nonce leak.

The issue allows for privilege escalation.

The issue allows for privilege escalation.

The issue is related to incorrect login access control. It allows access with only the knowledge of an e-mail address, which is insufficient for secure authentication.

The issue concerns a privilege escalation in the PeepSoProfilePreferencesAjax->save() function.

The issue allows remote attackers to conduct PHP object injection attacks. This is achieved by sending crafted serialized values in a POST request.