CVE-2010-4756 affecting package glibc 2.35-7
CVE-2010-4756 affecting package glibc 2.35-7. This CVE either no longer is or was never...
6.4AI Score
0.008EPSS
CVE-2023-0687 affecting package glibc 2.35-7
CVE-2023-0687 affecting package glibc 2.35-7. This CVE either no longer is or was never...
9.8CVSS
9.6AI Score
0.001EPSS
CVE-2022-4055 affecting package xdg-utils 1.1.3-7
CVE-2022-4055 affecting package xdg-utils 1.1.3-7. No patch is available...
7.4CVSS
7.5AI Score
0.001EPSS
CVE-2022-1941 affecting package grpc 1.42.0-7
CVE-2022-1941 affecting package grpc 1.42.0-7. This CVE either no longer is or was never...
7.5CVSS
8AI Score
0.002EPSS
CVE-2022-40898 affecting package python-wheel 0.33.6-7
CVE-2022-40898 affecting package python-wheel 0.33.6-7. No patch is available...
7.5CVSS
7.7AI Score
0.003EPSS
CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7
CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7. A patched version of the package is...
9.8CVSS
7.3AI Score
0.001EPSS
CVE-2020-27748 affecting package xdg-utils 1.1.3-7
CVE-2020-27748 affecting package xdg-utils 1.1.3-7. No patch is available...
6.5CVSS
7.5AI Score
0.002EPSS
CVE-2019-16707 affecting package hunspell 1.7.0-7
CVE-2019-16707 affecting package hunspell 1.7.0-7. This CVE either no longer is or was never...
6.5CVSS
7AI Score
0.003EPSS
CVE-2023-25153 affecting package k3s for versions less than 1.25.5-7
CVE-2023-25153 affecting package k3s for versions less than 1.25.5-7. This CVE either no longer is or was never...
6.2CVSS
6.9AI Score
0.001EPSS
CVE-2022-4904 affecting package grpc 1.42.0-7
CVE-2022-4904 affecting package grpc 1.42.0-7. No patch is available...
8.6CVSS
8.9AI Score
0.001EPSS
CVE-2021-46023 affecting package rust 1.72.0-7
CVE-2021-46023 affecting package rust 1.72.0-7. This CVE either no longer is or was never...
7.5CVSS
7.6AI Score
0.001EPSS
CVE-2016-2568 affecting package polkit 0.116-7
CVE-2016-2568 affecting package polkit 0.116-7. No patch is available...
7.8CVSS
7.5AI Score
0.0004EPSS
CVE-2019-20633 affecting package patch 2.7.6-7
CVE-2019-20633 affecting package patch 2.7.6-7. No patch is available...
5.5CVSS
7.5AI Score
0.001EPSS
CVE-2022-3857 affecting package qt5-qtbase 5.12.11-7
CVE-2022-3857 affecting package qt5-qtbase 5.12.11-7. No patch is available...
5.5CVSS
7.5AI Score
0.001EPSS
CVE-2021-25741 affecting package kubernetes-1.21.2 1.21.2-7
CVE-2021-25741 affecting package kubernetes-1.21.2 1.21.2-7. No patch is available...
8.8CVSS
8.9AI Score
EPSS
CVE-2021-25741 affecting package kubernetes-1.20.9 1.20.9-7
CVE-2021-25741 affecting package kubernetes-1.20.9 1.20.9-7. No patch is available...
8.8CVSS
8.9AI Score
EPSS
CVE-2022-41725 affecting package gcc 9.1.0-7
CVE-2022-41725 affecting package gcc 9.1.0-7. This CVE either no longer is or was never...
7.5CVSS
9.9AI Score
0.001EPSS
CVE-2021-3996 affecting package util-linux 2.32.1-7
CVE-2021-3996 affecting package util-linux 2.32.1-7. This CVE either no longer is or was never...
5.5CVSS
5.9AI Score
0.0004EPSS
CVE-2022-41724 affecting package gcc 9.1.0-7
CVE-2022-41724 affecting package gcc 9.1.0-7. This CVE either no longer is or was never...
7.5CVSS
9AI Score
0.001EPSS
CVE-2021-25741 affecting package kubernetes-1.19.11 1.19.11-7
CVE-2021-25741 affecting package kubernetes-1.19.11 1.19.11-7. No patch is available...
8.8CVSS
8.9AI Score
EPSS
CVE-2023-25193 affecting package qt5-qtbase 5.12.11-7
CVE-2023-25193 affecting package qt5-qtbase 5.12.11-7. This CVE either no longer is or was never...
7.5CVSS
8.2AI Score
0.002EPSS
CVE-2021-3995 affecting package util-linux 2.32.1-7
CVE-2021-3995 affecting package util-linux 2.32.1-7. This CVE either no longer is or was never...
5.5CVSS
5.9AI Score
0.0004EPSS
CVE-2021-25741 affecting package kubernetes-1.21.1 1.21.1-7
CVE-2021-25741 affecting package kubernetes-1.21.1 1.21.1-7. No patch is available...
8.8CVSS
8.9AI Score
EPSS
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
6.1CVSS
EPSS
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
6.1CVSS
6.1AI Score
EPSS
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
6.1CVSS
6.6AI Score
EPSS
The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1.0.8.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
6.1CVSS
EPSS
9.8CVSS
9.6AI Score
0.038EPSS
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an.....
4.6CVSS
0.0004EPSS
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory with the goal of privilege...
3.7CVSS
4.1AI Score
0.0004EPSS
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory with the goal of privilege...
3.7CVSS
0.0004EPSS
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an.....
4.6CVSS
4.7AI Score
0.0004EPSS
CVE-2024-39302 Some bbb-record-core files installed with wrong file permission
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory with the goal of privilege...
3.7CVSS
0.0004EPSS
CVE-2024-38518 bbb-web API additional parameters considered
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an.....
4.6CVSS
0.0004EPSS
Kimsuky Using TRANSLATEXT Chrome Extension to Steal Sensitive Data
The North Korea-linked threat actor known as Kimsuky has been linked to the use of a new malicious Google Chrome extension that's designed to steal sensitive information as part of an ongoing intelligence collection effort. Zscaler ThreatLabz, which observed the activity in early March 2024, has...
7.8CVSS
7.5AI Score
0.974EPSS
Grafana XSS in header column rename in github.com/grafana/grafana
Grafana XSS in header column rename in...
6.1CVSS
5.8AI Score
0.005EPSS
3 More Plugins Infected in WordPress.org Supply Chain Attack Due to Compromised Developer Passwords
Update #1: As of 12:36PM EST, another plugin has been infected. We've updated the list below to include this fourth plugin and the plugins team has been notified. Update #2: As of 2:20 PM EST, two more plugins appear to have malicious commits, however, the releases have not officially been made...
7.1AI Score
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated...
8.1CVSS
6.9AI Score
0.0004EPSS
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated...
8.1CVSS
0.0004EPSS
It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated...
8.1CVSS
0.0004EPSS
EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1859)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the...
8CVSS
8.1AI Score
0.0004EPSS
VMware ESXi 7.0 / 8.0 Out-of-Bounds read (CVE-2024-37086)
The version of VMware ESXi installed on the remote host is prior to 7.0 Update 3q or 8.0 prior to 8.0 Update 3. It is, therefore, affected by an out-of-bounds read vulnerability as referenced in the VMSA-2024-0013 advisory: Note that Nessus has not tested for these issues but has instead relied...
6.8CVSS
7AI Score
0.0004EPSS
VMware ESXi 7.0 / 8.0 Authenticaton Bypass (CVE-2024-37085)
The version of VMware ESXi installed on the remote host is prior to 8.0 Update 3. It is, therefore, affected by an authentication bypass vulnerability as referenced in the VMSA-2024-0013 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's...
6.8CVSS
7.4AI Score
0.0004EPSS
EulerOS 2.0 SP12 : unbound (EulerOS-SA-2024-1863)
According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a...
8CVSS
8AI Score
0.05EPSS
EulerOS 2.0 SP12 : shim (EulerOS-SA-2024-1862)
According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications...
6.5CVSS
6.5AI Score
0.003EPSS
EulerOS 2.0 SP12 : unbound (EulerOS-SA-2024-1877)
According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a...
8CVSS
8AI Score
0.05EPSS
EulerOS 2.0 SP12 : shim (EulerOS-SA-2024-1876)
According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications...
6.5CVSS
6.5AI Score
0.003EPSS
EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1873)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the...
8CVSS
8.3AI Score
0.0004EPSS
Decoding OWASP – A Security Engineer’s Roadmap to Application Security
In a time where over 60% of data breaches are linked to software vulnerabilities and a single overlooked software vulnerability can expose sensitive data, the imperative of robust application security cannot be overstated. The 2023 IBM Security Cost of a Data Breach Report highlights that...
8.4AI Score
Summary Multiple vulnerabilities within WebSphere Application and IBM HTTP Server and Java which is included as part of IBM Tivoli Monitoring (ITM) portal server. have been remediated. Vulnerability Details ** CVEID: CVE-2024-22354 DESCRIPTION: **IBM WebSphere Application Server 8.5, 9.0 and IBM...
7.5CVSS
8.5AI Score
0.001EPSS