Design/Logic Flaw

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

SKINsoft S-Museum Security Vulnerability

SKINsoft S-Museum is a web-based system from the French company SKINsoft. It is suitable for museums of all sizes and types. A security vulnerability exists in SKINsoft S-Museum version 7.02.3, which originates from a cross-site scripting XSS attack that allows an attacker to conduct a cross-site...

CVE-2024-25802

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content...

CVE-2024-25801: Improper Neutralization of Input During Web Page Generation

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 is affected by CVE-2024-25801: an XSS vulnerability where the attack payload is delivered in the filename of an uploaded file (not its content). Product: SKINsoft S-Museum; Vulnerable component: filename handling during upload via Add Media. Impact: stored/ reflected XSS ...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

CVE-2024-25802

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

CVE-2024-25802: Unrestricted Upload of File with Dangerous Type

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attack payload is the file content...

SKINsoft S-Museum Security Vulnerability

SKINsoft S-Museum is a web-based system from the French company SKINsoft. It is suitable for museums of all sizes and types. A security vulnerability exists in SKINsoft S-Museum version 7.02.3, which stems from the presence of an arbitrary file upload vulnerability. An attacker can exploit the...

PT-2024-21139

Name of the Vulnerable Software and Affected Versions SKINsoft S-Museum version 7.02.3 Description The issue allows for Unrestricted File Upload via the Add Media function. This is achieved by using the file content as the attack payload. Recommendations For SKINsoft S-Museum version 7.02.3,...

CVE-2024-25802

Affected software: SKINsoft S-Museum 7.02.3. Vulnerability: Unrestricted file upload via the Add Media function. The attack payload, in this case, is the file content (not the filename). Root cause / nature: Arbitrary file upload capability exists in the Add Media workflow. Impact (as stated): Hi...

PT-2024-21138

Name of the Vulnerable Software and Affected Versions SKINsoft S-Museum version 7.02.3 Description The issue allows for arbitrary code execution via a crafted PDF file uploaded through the Add Media function. Additionally, it is possible to execute a cross-site scripting XSS attack by manipulatin...

CVE-2024-1349: Improper Neutralization of Input During Web Page Generation

The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.9.8 due to insufficient input...

Fedora: Security Advisory for bind-dyndb-ldap (FEDORA-2024-21310568fa)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the email encryption software for Jira S/Notify, related to the， allows a hacker to perform a CSRF attack.

The vulnerability of the email encryption software for Jira S/Notify is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to execute a CSRF attack remotely...

The vulnerability of the SAP S/4HANA Finance financial management software, related to incorrect authorization, allows a perpetrator to create internal bank accounts.

The vulnerability of the SAP S/4HANA Finance financial management software is related to incorrect authorization processes. Exploiting this vulnerability allows a malicious actor to create internal bank accounts remotely...

Debian: Security Advisory (DSA-5617-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JetBrains TeamCity Authentication Bypass Flaw, Paving the Way for Server Takeover

Summary: JetBrains addressed a critical security flaw in its TeamCity On-Premises product. The vulnerability identified as CVE-2024-23917, could potentially allow an unauthorized attacker with HTTPS access to a TeamCity server to circumvent authentication mechanisms and acquire administrative...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an int as an index for an array. The typechecker allows the usage of...