CVE-2024-34695

WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.

• CWE-799

• https://github.com/SakuraIsayeki/WOWS-Karma/commit/3210b516fa3551e30fe760c915f7656d9046e69a
• https://github.com/SakuraIsayeki/WOWS-Karma/commit/6cb825976f28c68d79172aeda00e955bf5853de2
• https://github.com/SakuraIsayeki/WOWS-Karma/security/advisories/GHSA-v6cc-v976-mj8g
• https://github.com/SakuraIsayeki/WOWS-Karma/commit/3210b516fa3551e30fe760c915f7656d9046e69a
• https://github.com/SakuraIsayeki/WOWS-Karma/commit/6cb825976f28c68d79172aeda00e955bf5853de2
• https://github.com/SakuraIsayeki/WOWS-Karma/security/advisories/GHSA-v6cc-v976-mj8g

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3469The GP Premium plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2024-34690SAP Student Life Cycle Management (SLcM) fails to conduct pr…5.4
• CVE-2024-34691Manage Incoming Payment Files (F1680) of SAP S/4HANA does no…6.5
• CVE-2024-34692Due to missing verification of file type or content, SAP Ena…4.6
• CVE-2024-34693Improper Input Validation vulnerability in Apache Superset, …5.3
• CVE-2024-34694LNbits is a Lightning wallet and accounts system. Paying inv…8.1
• CVE-2024-34696GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-34697FreeScout is a free, self-hosted help desk and shared mailbo…6.1
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34701CreateWiki is Miraheze's MediaWiki extension for requesting …5.9