SvelteKit 跨站脚本漏洞

SvelteKit is an open source web development framework from Svelte. A cross-site scripting vulnerability exists in SvelteKit versions prior to 2.8.3, which stems from the presence of unpurified input data and user-controllable data flow in a particular file, making it susceptible to cross-site...

CVE-2024-9105

CVE-2024-9105 — UltimateAI WordPress plugin authentication bypass The UltimateAI plugin for WordPress (Ultimate AI) is vulnerable to an authentication bypass in versions up to 2.8.3. The root cause is insufficient verification on the user parameter in the function ultimate_ai_register_or_login_wi...

PT-2024-39433 · WordPress · Ultimateai

Name of the Vulnerable Software and Affected Versions: The UltimateAI plugin for WordPress versions up to, and including, 2.8.3 Description: The issue is due to insufficient verification on the user being supplied in the ultimate ai register or login with google function. This makes it possible f...

CVE-2024-43395

CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without...

openSUSE Security Advisory (openSUSE-SU-2024:0211-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Advanced custom fields, 2.7.7, SQL Injection

Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...

PT-2024-28388 · Unknown · Luci-App-Lucky

Name of the Vulnerable Software and Affected Versions: luci-app-lucky version 2.8.3 Description: The issue is related to hardcoded credentials in the software. Recommendations: For luci-app-lucky version 2.8.3, update to a version where the hardcoded credentials issue is resolved, if available. A...

WordPress plugin WooCommerce Canada Post Shipping Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in th...

CVE-2024-31273

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.3...

PT-2024-23918 · WordPress · Js Help Desk

Name of the Vulnerable Software and Affected Versions: JS Help Desk – Best Help Desk & Support Plugin versions 2.8.3 and earlier Description: A Missing Authorization issue affects the JS Help Desk plugin. This issue allows unauthorized access, potentially leading to security breaches. The estimat...

WordPress plugin JS Help Desk security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2024-32737

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "querycontractresult" function within MCUDBHelper...

Cyber Power Systems PowerPanel Enterprise 安全漏洞

Cyber Power Systems PowerPanel Enterprise is a software program from Cyber Power Systems designed to provide real-time PUE, PUE trends, and total energy use trends. A security vulnerability exists in Cyber Power Systems PowerPanel Enterprise prior to version v2.8.3 that stems from an SQL injectio...

PT-2024-4518 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description: The issue is related to missing authentication for certain utilities in CyberPower PowerPanel Enterprise, allowing an unauthenticated remote attacker to access the PDNU RES...

PT-2024-4530 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description: The issue is related to a SQL injection vulnerability in the query contract result function of the MCUDBHelper component in the corporate version of the PowerPanel Enterpri...

PT-2024-24820

Name of the Vulnerable Software and Affected Versions CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description A sql injection issue exists, allowing an unauthenticated remote attacker to leak sensitive information via the query ptask verbose function within MCUDBHelper. Recommendatio...

WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Plugin JS Help Desk versions = 2.8.3...

WordPress ShopLentor plugin <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via WL Universal Product Layout vulnerability discovered by wesley wcraft in WordPress Plugin ShopLentor versions = 2.8.3...

CVE-2024-29735 Apache Airflow: Potentially harmful permission changing by log task handler

Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix...

GHSA-H574-6646-VFXX Apache Airflow: Ignored Airflow Permission

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airflow are recommended to upgrade to...