PT-2024-20334 · Teamwire · Teamwire Windows Desktop Client

Name of the Vulnerable Software and Affected Versions: Teamwire Windows desktop client versions 2.0.1 through 2.4.0 Description: A Cross Site Scripting XSS issue allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username, and group...

Rack CORS Middleware has Insecure File Permissions

rack-cors aka Rack CORS Middleware 2.0.1 has 0666 permissions for the .rb files...

Rack Security Vulnerabilities

Rack is a modular Ruby web server interface. A security vulnerability exists in rack-cors version 2.0.1 that stems from the presence of insecure file permissions...

[SECURITY] Fedora 38 Update: rust-silver-2.0.1-7.fc38

A cross-shell customizable powerline-like prompt with icons...

PT-2024-10354 · Drupal · Node Access Rebuild Progressive

Name of the Vulnerable Software and Affected Versions: Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication. Description: The issue is related to improper...

CVE-2024-23516

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Calculators World CC BMI Calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through 2.0.1...

PT-2024-19917 · Unknown · Calculators World Cc Bmi Calculator

Name of the Vulnerable Software and Affected Versions: Calculators World CC BMI Calculator versions n/a through 2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the Calculators...

Security Bulletin: Kubernetes secrets in IBM Storage Defender Connection Manager on-prem environment are not encrypted by default (CVE-2023-50957, CVE-2024-22312, CVE-2024-22313)

Summary Kubernetes secrets in the IBM Storage Defender Connection Manager on-premises environment OVA are obfuscated using base64 encoding instead of being encrypted. An attacker who has gained root access to the environment can read the secrets from the Kubernetes configuration. The...

GHSA-78XJ-CGH5-2H22 NPM IP package incorrectly identifies some private IP addresses as public

The isPublic function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery SSRF if isPublic is used to...

NPM IP package incorrectly identifies some private IP addresses as public

The isPublic function in the NPM package ip doesn't correctly identify certain private IP addresses in uncommon formats such as 0x7F.1 as private. Instead, it reports them as public by returning true. This can lead to security issues such as Server-Side Request Forgery SSRF if isPublic is used to...

PT-2024-14248 · Themify · Themify Icons

Name of the Vulnerable Software and Affected Versions: Themify Icons versions n/a through 2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

WordPress CC BMI Calculator Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software CC BMI Calculator Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-23516 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 97ea4e3b7d56 Credits Ngô Thiên An ancorn from VNPT-VCI...

Malicious code in vscode-mlir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c610eb26b75afffa49527255692e967a24bbe7fd61242d8c2f45420c72d9b589 The OpenSSF Package Analysis project identified 'vscode-mlir' @ 2.0.1 npm as malicious. It is considered malicious because: - The package execut...

CVE-2022-41786

Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1...

PT-2024-11651 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Job Board versions n/a through 2.0.1 Description: The issue is related to a Missing Authorization vulnerability in WP Job Portal. This vulnerability affects the WP Job Portal – A Complete Job Board plugin...

Sql injection

A vulnerability classified as critical has been found in Inis up to 2.0.1. Affected is an unknown function of the file /app/api/controller/default/Sqlite.php. The manipulation of the argument sql leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-250110 is t...

CVE-2024-0342

CVE-2024-0342 affects Inis up to version 2.0.1. The vulnerability is a SQL injection in an unknown function within the file /app/api/controller/default/Sqlite.php, triggered by manipulating the argument sql. The exploit has been disclosed publicly. Affected products, root cause, and intended impa...

CVE-2024-0341 Inis GET Request File.php path traversal

A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to path traversal: '../filedir'. The explo...

Inis security breach

Inis is a web application. A security vulnerability exists in Inis version 2.0.1, which stems from the parameter path in the file /app/api/controller/default/File.php that causes path traversal...

Inis SQL Injection Vulnerability

Inis is a web application. Inis version 2.0.1 suffers from a SQL injection vulnerability that stems from the parameter sql in the file /app/api/controller/default/Sqlite.php that can lead to SQL injection...