CVE-2024-45786

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...

CVE-2024-45790

CVE-2024-45790 affects Reedos aiM-Star 2.0.1. Root cause: missing restrictions for excessive failed authentication attempts on the API login, enabling brute-force attempts that could lead to unauthorized access and compromise other user accounts. NVD lists CVSSv3.1 base score 9.8 (CRITICAL) with ...

Reedos aiM-Star 安全漏洞

Reedos aiM-Star is a software product from Reedos for mutual fund distribution. A security vulnerability exists in Reedos aiM-Star version 2.0.1 that stems from improper access control to certain API endpoints, which allows an attacker to manipulate parameters to access sensitive information via ...

WordPress Remember Me Controls plugin <= 2.0.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Remember Me Controls versions = 2.0.1...

Malicious code in @maas-tools/nested-browser-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6c3a06451f8c94f543e39c01595521037c5dba7f8873e64db843e17be7bb8b1 The OpenSSF Package Analysis project identified '@maas-tools/nested-browser-router' @ 2.0.1 npm as malicious. It is considered malicious because...

Security Bulletin: Vulnerability in SnakeYaml affects watsonx.data

Summary SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml coul...

Security Bulletin: Vulnerabilities in Golang Go affect watsonx.data

Summary Golang Go has multiple vulnerabilities that include HTTP request smuggling, remote attacks to obtain sensitive information, denial of service, and unspecified errors with return an incorrect results. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2022-1705 DESCRIPTION:...

CVE-2024-8255

Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability...

firefox security update

115.14.0-2.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 115.14.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 115.14.0-2 - Update to 115.14.0 build2 115.14.0-1 - Update to 115.14.0 build1...

WordPress plugin Add Admin CSS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-37704 · WordPress · Add Admin Css

Name of the Vulnerable Software and Affected Versions: Add Admin CSS plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin uses bootstrap and leaves test files with display errors on. This allows...

PT-2024-28950

Name of the Vulnerable Software and Affected Versions Fastapi OPA versions prior to 2.0.1 Description The issue allows unauthenticated attackers to discover which entities exist within an application by sending HTTP OPTIONS requests. This is because OpaMiddleware allows all HTTP OPTIONS requests...

WordPress Pricing Table plugin <= 2.0.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Pricing Table versions = 2.0.1...

WordPress Webico Slider Flatsome Addons plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wbcimage Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Webico Slider Flatsome Addons versions = 2.0.1...

PT-2024-29200 · WordPress · Pricing Table

Name of the Vulnerable Software and Affected Versions: Pricing Table plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax function. This allows unauthenticated attackers t...

PT-2024-37569 · Wbw · The Product Table

Name of the Vulnerable Software and Affected Versions: The Product Table by WBW plugin for WordPress version 2.0.1 and earlier Description: The issue is related to Remote Code Execution due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file...

Security Bulletin: IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation.

Summary IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details...

PT-2024-27785 · Nepstech · Nepstech Wifi Router Xpon

Name of the Vulnerable Software and Affected Versions: Nepstech Wifi Router xpon terminal NTPL-Xpon1GFEVN, hardware version 1.0, firmware version 2.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the router's Telnet port 2345 without requiring authentication...

PT-2024-31915 · WordPress · Widget Bundle

Name of the Vulnerable Software and Affected Versions: Widget Bundle WordPress plugin versions prior to 2.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2024-33642 · WordPress · Widget Bundle

Name of the Vulnerable Software and Affected Versions: Widget Bundle WordPress plugin versions prior to 2.0.1 Description: The issue is related to the lack of CSRF checks when logging widgets. This could allow attackers to make logged-in admins enable or disable widgets via a CSRF attack...