WordPress WPSchoolPress plugin <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover vulnerability

Missing Authorization to Privilege Escalation via Account Takeover vulnerability discovered by wesley wcraft in WordPress Plugin WPSchoolPress versions = 2.2.16...

CVE-2024-38458

Xenforo before 2.2.16 allows code injection...

CVE-2024-38457

Xenforo before 2.2.16 allows CSRF...

PT-2024-28013 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For versions prior to 2.2.16, update to version...

CVE-2024-38457

CVE-2024-38457 affects XenForo software prior to 2.2.16. The vulnerability is a Cross-Site Request Forgery (CSRF) in the Widget::actionSave flow, where XenForo does not check GET vs POST before saving a widget. Anti-CSRF checks are applied only to POST requests, enabling CSRF attacks that can cre...

PT-2024-28014 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows code injection. Recommendations: For versions prior to 2.2.16, update to version 2.2.16 or later to resolve the issue...

CVE-2024-38458

Summary: CVE-2024-38458 affects XenForo, with versions prior to 2.2.16 vulnerable via the Template system, enabling code execution. The 1337DAY/PacketStorm entries describe a remote-code-execution path in XenForo

Jenkins Plugin requests-plugin授权问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project. jenkins Plugin is an application. jenkins Plugin requests-plugin version...

Incorrect Authorization in Jenkins requests-plugin

An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests. This is basically the...

PT-2022-22333 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins requests-plugin Plugin versions 2.2.16 and earlier Description: An incorrect permission check in the Jenkins requests-plugin Plugin allows attackers with Overall/Read permission to view the list of pending requests. This issue is...

objection.js Prototype Pollution vulnerability

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'. This issue is patched in version 2.2.16...

PT-2021-7493 · Haproxy +2 · Haproxy +2

Name of the Vulnerable Software and Affected Versions: HAProxy versions 2.2 before 2.2.16 HAProxy versions 2.3 before 2.3.13 HAProxy versions 2.4 before 2.4.3 Description: The issue is related to a mismatch between Host and authority being mishandled, which can lead to an attacker-controlled HTTP...

CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that...

CVE-2020-36327

Bundler (Ruby) versions 1.16.0–2.2.9 and 2.2.11–2.2.17 are vulnerable to dependency-confusion: a rogue gem at a public source can be chosen if it has a higher version, potentially replacing an intended private gem. This is the issue described as CVE-2020-36327, with confirmed remediation upstream...

Bundler 安全漏洞

Bundler is a software application. It provides a consistent environment for Ruby projects by tracking and installing the exact gem and version required. A security vulnerability exists in Bundler versions 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16, which stems from the fact that dependency...

Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. FILEUPLOADDIRECTORYPERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level...

GHSA-FR28-569J-53C4 Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077...

EulerOS Virtualization for ARM 64 3.0.6.0 : gnupg2 (EulerOS-SA-2020-1358)

According to the version of the gnupg2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it...