Frontend File Manager & Sharing – User Private Files Security Vulnerabilities

CVE-2024-5332

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-5332

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3633

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4105

A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product...

CVE-2024-3633

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4105

A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product...

CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG

The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS...

CVE-2024-5332 Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Card widget in all versions up to, and including, 2.6.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4105

A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product...

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack

Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library ("polyfill.js") to redirect users to malicious and scam sites. More than 110,000 sites that embed the library are impacted by...

CVE-2024-37138

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the...

CVE-2024-37138

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the...

CVE-2024-37138

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

CVE-2024-28973

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted...

CVE-2024-28973

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: grype, kubevela, helm, melange, tekton-pipelines, ctop, kaniko, fuse-overlayfs-snapshotter, zot, eksctl, helm-push, kubescape, skaffold, cert-manager, flux-source-controller, flux-helm-controller, trivy, gitness, telegraf, k3d, neuvector-agent, up,...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: helm-operator, k9s, eksctl, cert-manager, zarf, zot, helm-push, flux-source-controller, istio-operator, up, k8sgpt, kots, cilium-cli, flux-helm-controller, kubescape, trivy,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: calico, grype, wireguard-go, kubevela, prometheus, go-md2man, flux-image-reflector-controller, delve, aws-ebs-csi-driver, consul, bazelisk, nodetaint, pulumi-language-yaml, lazygit, docker-credential-acr-env, regclient, helm-push, slsa-verifier, vt-cli,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: calico, grype, wireguard-go, aactl, flux-notification-controller, kubevela, prometheus, dotnet, nodetaint, pulumi-language-yaml, ko, slsa-verifier, kubernetes-csi-livenessprobe, kubescape, tctl, hey, pulumi, minio, sigstore-scaffolding, cert-manager, metacontroller,...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: cosign, aactl, tkn, tekton-pipelines, istio-pilot-discovery, vault, gitsign, slsa-verifier, terragrunt, external-secrets-operator, kubescape, dex, sops, cilium-envoy, argo-cd, cert-manager, tekton-chains, argo-workflows, flux-source-controller, kyverno, rekor, fulcio,....

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: aactl, prometheus, tekton-pipelines, ctop, goreleaser, slsa-verifier, kubescape, skaffold, chartmuseum, cert-manager, tekton-chains, k3d, falco, k3s, paranoia, scorecard, kpt, up, loki,...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: helm-operator, k9s, eksctl, cert-manager, zarf, zot, helm-push, flux-source-controller, istio-operator, up, k8sgpt, kots, cilium-cli, flux-helm-controller, kubescape, trivy,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: calico, grype, aactl, flux-notification-controller, kubevela, prometheus, flux-image-reflector-controller, aws-ebs-csi-driver, consul, nodetaint, cilium, k9s, pulumi-language-yaml, zot, slsa-verifier, kubernetes-csi-livenessprobe, kubescape, trust-manager, tctl,...

CVE-2024-6104 vulnerabilities

Vulnerabilities for packages: skopeo, cosign, aactl, flux-notification-controller, kubevela, buildkitd, bank-vaults, nuclei, prometheus, tkn, flux-image-reflector-controller, tekton-pipelines, gitlab-runner, glab, falcoctl, consul, goreleaser, zarf, zot, gitsign, slsa-verifier, policy-controller,.....

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: wireguard-go, aactl, flux-notification-controller, confluent-common-docker, go-md2man, flux-image-reflector-controller, overmind, delve, falcosidekick, mods, aws-ebs-csi-driver, k9s, zot, pulumi-language-yaml, lazygit, docker-credential-acr-env, ko, helm-push,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: wireguard-go, aactl, flux-notification-controller, confluent-common-docker, go-md2man, flux-image-reflector-controller, overmind, delve, falcosidekick, mods, aws-ebs-csi-driver, k9s, zot, pulumi-language-yaml, lazygit, docker-credential-acr-env, ko, helm-push,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, vcluster, bazelisk, nodetaint, k9s, neuvector-sigstore-interface, velero-plugin-for-aws, docker-credential-acr-env, ko, helm-push, slsa-verifier, kubecolor, tempo, hey, nri-consul, dockerize, cert-manager, kubernetes-event-exporter,...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: skopeo, cosign, aactl, flux-notification-controller, kubevela, buildkitd, bank-vaults, nuclei, prometheus, tkn, flux-image-reflector-controller, tekton-pipelines, gitlab-runner, glab, falcoctl, consul, goreleaser, zarf, zot, gitsign, slsa-verifier, policy-controller,.....

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: aactl, prometheus-bind-exporter, go-md2man, render-template, grpcurl, influx, ctop, cass-operator, gops, goreleaser, helm-push, local-path-provisioner, slsa-verifier, prometheus-stackdriver-exporter, configmap-reload, nri-discovery-kubernetes, cni-plugins, gosu,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: skopeo, cosign, aactl, filebeat, kubevela, buildkitd, helm, prometheus, flux-image-reflector-controller, tekton-pipelines, gitlab-runner, ctop, docker-credential-gcr, k8sgpt, istio-pilot-discovery, falcoctl, cadvisor, goreleaser, k9s, eksctl, timoni, gitsign, zarf,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: calico, grype, aactl, flux-notification-controller, kubevela, prometheus, flux-image-reflector-controller, aws-ebs-csi-driver, consul, nodetaint, cilium, k9s, pulumi-language-yaml, zot, slsa-verifier, kubernetes-csi-livenessprobe, kubescape, trust-manager, tctl,...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: calico, ipfs, cert-manager, k3s, kubevela, prometheus, up, gitlab-kas, caddy, kubernetes, thanos, gatekeeper, prometheus-adapter,...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: calico, ipfs, cert-manager, k3s, kubevela, prometheus, up, gitlab-kas, caddy, kubernetes, thanos, gatekeeper, prometheus-adapter,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: calico, grype, wireguard-go, kubevela, prometheus, go-md2man, flux-image-reflector-controller, delve, aws-ebs-csi-driver, consul, bazelisk, nodetaint, pulumi-language-yaml, lazygit, docker-credential-acr-env, regclient, helm-push, slsa-verifier, vt-cli,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: cosign, filebeat, buildkitd, bank-vaults, nuclei, prometheus, fluent-bit-plugin-loki, step, flux-image-reflector-controller, tekton-pipelines, gitlab-runner, grafana, tkn, k8sgpt, falcoctl, goreleaser, zarf, zot, py3-cassandra-medusa, boring-registry,...

GHSA-M5VV-6R4H-3VJ9 vulnerabilities

Vulnerabilities for packages: cosign, filebeat, buildkitd, bank-vaults, nuclei, prometheus, fluent-bit-plugin-loki, step, flux-image-reflector-controller, tekton-pipelines, gitlab-runner, grafana, tkn, k8sgpt, falcoctl, goreleaser, zarf, zot, py3-cassandra-medusa, boring-registry,...

CVE-2023-3978 vulnerabilities

Vulnerabilities for packages: wireguard-go, aactl, flux-notification-controller, kubevela, prometheus, flux-image-reflector-controller, consul, aws-ebs-csi-driver, nodetaint, zot, pulumi-language-yaml, kubernetes-csi-livenessprobe, trust-manager, tctl, hey, pulumi, minio, prometheus-operator,...

CVE-2023-48795 vulnerabilities

Vulnerabilities for packages: calico, grype, wireguard-go, aactl, prometheus, flux-image-reflector-controller, consul, zot, docker-credential-acr-env, ko, helm-push, slsa-verifier, kubescape, temporal-server, pulumi, dockerize, secrets-store-csi-driver-provider-azure, sigstore-scaffolding,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: calico, grype, wireguard-go, kubevela, prometheus, go-md2man, flux-image-reflector-controller, delve, aws-ebs-csi-driver, consul, bazelisk, nodetaint, pulumi-language-yaml, lazygit, docker-credential-acr-env, regclient, helm-push, slsa-verifier, vt-cli,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: calico, flux-image-reflector-controller, bazelisk, nodetaint, k9s, neuvector-sigstore-interface, velero-plugin-for-aws, docker-credential-acr-env, ko, helm-push, slsa-verifier, kubecolor, tempo, nri-consul, dockerize, cert-manager, kubernetes-event-exporter,...

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: wireguard-go, aactl, flux-notification-controller, kubevela, prometheus, flux-image-reflector-controller, consul, aws-ebs-csi-driver, nodetaint, zot, pulumi-language-yaml, slsa-verifier, kubernetes-csi-livenessprobe, kubescape, trust-manager, tctl, hey, pulumi, minio,....

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: calico, flux-image-reflector-controller, bazelisk, nodetaint, k9s, neuvector-sigstore-interface, velero-plugin-for-aws, docker-credential-acr-env, ko, helm-push, slsa-verifier, kubecolor, tempo, nri-consul, dockerize, cert-manager, kubernetes-event-exporter,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, vcluster, bazelisk, nodetaint, k9s, neuvector-sigstore-interface, velero-plugin-for-aws, docker-credential-acr-env, ko, helm-push, slsa-verifier, kubecolor, tempo, hey, nri-consul, dockerize, cert-manager, kubernetes-event-exporter,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: skopeo, cosign, aactl, tkn, step, melange, tekton-pipelines, weaviate, grafana, istio-pilot-discovery, falcoctl, grpc-health-probe, vault, cilium, goreleaser, zarf, frp, gitsign, ko, slsa-verifier, policy-controller, terragrunt, keda, external-secrets-operator,...