CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

CVE-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

volunteermanitoba.ca Cross Site Scripting vulnerability OBB-3855085

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Password Protected Plugin <= 2.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Password Protected Type Plugin Vulnerable versions = 2.6.6 Fixed in 2.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0656 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7a68f344cd36 Credits Felipe Restrepo...

WordPress ProfilePress Plugin <= 4.14.4 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.14.4 Fixed in 4.15.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1519 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID abd5fc026e9d Credits stealthcopter...

CVE-2024-0874

creationtimestamp| type| source ---|---|--- 2024-02-18 11:41:29+00:00| seen| https://t.me/ctinow/187221 2025-01-20 09:59:36+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/2355 2025-03-20 03:29:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8167...

SUSE CVE-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

CVE-2023-5080

creationtimestamp| type| source ---|---|--- 2024-02-15 20:56:59+00:00| seen| https://t.me/ctinow/185864...

CVE-2024-22504

creationtimestamp| type| source ---|---|--- 2024-02-11 12:20:51+00:00| seen| https://t.me/arpsyndicate/3360...

CVE-2023-46350

creationtimestamp| type| source ---|---|--- 2024-02-09 09:21:43+00:00| seen| https://t.me/ctinow/181902 2024-03-02 19:46:43+00:00| seen| https://t.me/ctinow/198457 2025-06-20 20:44:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19070...

SUSE SLES15 Security Update : kernel (Live Patch 20 for SLE 15 SP4) (SUSE-SU-2024:0428-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0428-1 advisory. This update for the Linux Kernel 5.14.21-1504002497 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a...

CVE-2023-6741

creationtimestamp| type| source ---|---|--- 2024-02-06 12:11:32+00:00| seen| https://t.me/ctinow/179933 2025-06-20 17:46:31+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19013...

CVE-2023-52101

creationtimestamp| type| source ---|---|--- 2024-02-06 08:07:14+00:00| seen| https://t.me/ctinow/179814 2025-06-20 17:46:40+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19020...

CVE-2024-20013

creationtimestamp| type| source ---|---|--- 2024-02-05 07:26:55+00:00| seen| https://t.me/ctinow/178998 2024-02-25 18:51:09+00:00| seen| https://t.me/ctinow/192976 2025-06-20 20:44:25+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19081...

CVE-2023-52112

creationtimestamp| type| source ---|---|--- 2024-02-03 21:26:52+00:00| seen| https://t.me/ctinow/178646 2025-06-20 17:46:38+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19018...

CVE-2023-44031

creationtimestamp| type| source ---|---|--- 2024-02-03 10:21:50+00:00| seen| https://t.me/ctinow/178468 2024-02-20 03:11:49+00:00| seen| https://t.me/ctinow/188060...

CVE-2024-24747

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

CVE-2022-46710

creationtimestamp| type| source ---|---|--- 2024-01-30 09:41:32+00:00| seen| https://t.me/ctinow/175776 2024-01-30 09:41:33+00:00| seen| https://t.me/ctinow/175777 2025-06-20 15:44:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18981...