AdRotate – Ad Manager & AdSense Ads Security Vulnerabilities

K000139615: Node.js vulnerability CVE-2024-27982

Security Advisory Description The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly,...

Visualizer: Tables and Charts Manager for WordPress < 3.11.0 - Missing Authorization to Arbitrary SQL Execution

Description The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for...

SUSE SLES12 Security Update : kernel (SUSE-SU-2024:1643-1)

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1643-1 advisory. In the Linux kernel, the following vulnerability has been resolved: netlabel: fix out-of-bounds memory accesses There are two...

SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for google-cloud SDK (SUSE-SU-SUSE-RU-2024:1637-1)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2024:1637-1 advisory. sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser...

K000139616: MySQL vulnerability CVE-2024-21051

Security Advisory Description Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

Patch Tuesday - May 2024

Microsoft is addressing 61 vulnerabilities this May 2024 Patch Tuesday. Microsoft has evidence of in-the-wild exploitation and/or public disclosure for three of the vulnerabilities published today. At time of writing, two of the vulnerabilities patched today are listed on CISA KEV. Microsoft is...

TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem...

TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem...

Microsoft and Adobe Patch Tuesday, May 2024 Security Update Review

Microsoft has released its May edition of Patch Tuesday. Let's take a deep dive into the crucial insights from Microsoft's Patch Tuesday updates for May 2024. Microsoft Patch Tuesday for May 2024 Microsoft Patch Tuesday's May 2024 edition addressed 67 vulnerabilities, including one critical and 59....

Only one critical vulnerability included in May’s Microsoft Patch Tuesday; One other zero-day in DWN Core

After a relatively hefty Microsoft Patch Tuesday in April, this month's security update from the company only included one critical vulnerability across its massive suite of products and services. In all, May's slate of vulnerabilities disclosed by Microsoft included 59 total CVEs, most of which...

CVE-2024-30039

Windows Remote Access Connection Manager Information Disclosure...

QakBot attacks with Windows zero-day (CVE-2024-30051)

In early April 2024, we decided to take a closer look at the Windows DWM Core Library Elevation of Privilege Vulnerability CVE-2023-36033, which was previously discovered as a zero-day exploited in the wild. While searching for samples related to this exploit and attacks that used it, we found a...

CVE-2024-30039 Windows Remote Access Connection Manager Information Disclosure Vulnerability

...

CVE-2024-34356

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user...

CVE-2024-34356

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user...

CVE-2024-33583

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33499

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33497

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33498

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33496

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33495

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33494

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-30209

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-30208

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-30207

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-30206

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-4129

Improper Authentication vulnerability in Snow Software AB Snow License Manager on Windows allows a networked attacker to perform an Authentication Bypass if Active Directory Authentication is enabled.This issue affects Snow License Manager: from 9.33.2 through...

CVE-2024-3952

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-35166

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a through...

CVE-2024-34556

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through...

CVE-2024-34557

Cross-Site Request Forgery (CSRF) vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through...

CVE-2024-34549

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Automattic WP Job Manager.This issue affects WP Job Manager: from n/a through...

CVE-2024-34416

Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through...

CVE-2024-32730

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the...

CVE-2024-32719

Missing Authorization vulnerability in WP Club Manager.This issue affects WP Club Manager: from n/a through...

CVE-2024-2290

The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization of untrusted input in the 'placement_slug' parameter. This makes it possible for authenticated attackers to inject a PHP Object. No POP chain is present in...

CVE-2024-28277

In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subject_name= parameter, enabling Stored Cross-Site Scripting (XSS) attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript...

CVE-2024-28276

Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via...

CVE-2024-28075

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating...

CVE-2024-26517

SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php...

CVE-2024-23473

The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with.....

CVE-2024-1693

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-34356 TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user...

FIN7 Group Leverages Sponsored Ads to Disseminate Malicious Payloads

...

CVE-2024-33583

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33499

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33498

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33497

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33496

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...

CVE-2024-33495

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions &lt; V3.0.1.1), SIMATIC RTLS Locating Manager...