PT-2024-34794 · Eclipse · Eclipse Ditto

Name of the Vulnerable Software and Affected Versions: Eclipse Ditto versions 3.0.0 through 3.5.5 Description: The user input of several input fields of the Eclipse Ditto Explorer User Interface was not properly neutralized, making it vulnerable to both Reflected and Stored XSS Cross Site...

Joomla core 3.0.0-3.10.16-elts,4.0.0-4.4.6,5.0.0-5.1.2 - Unauthenticated Cache Poisoning in Pagination vulnerability

Unauthenticated Cache Poisoning in Pagination vulnerability discovered by ? in WordPress Core Joomla versions 3.0.0-3.10.16-elts,4.0.0-4.4.6,5.0.0-5.1.2...

Neos Flow Arbitrary file upload and XML External Entity processing

It has been discovered that Flow 3.0.0 allows arbitrary file uploads, inlcuding server-side scripts, posing the risk of attacks. If those scripts are executed by the server when accessed through their public URL, anything not blocked through other means is possible information disclosure, placeme...

WordPress plugin JupiterX 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2024-13385 · Nordic Semiconductor · Nrf Sniffer For Bluetooth Le

Name of the Vulnerable Software and Affected Versions: Nordic Semiconductor nRF Sniffer for Bluetooth LE versions 3.0.0 through 4.1.1 Description: The issue is related to incorrect file permissions set for certain scripts in the Nordic Semiconductor nRF Sniffer for Bluetooth LE. This allows...

PT-2024-14573 · Huawei · Harmonyos/Emui

Name of the Vulnerable Software and Affected Versions: Huawei HarmonyOS/EMUI versions 3.0.0 through 4.0.0 Description: The issue is a double-free vulnerability in the RSMC module. Successful exploitation of this vulnerability will affect availability, potentially leading to system compromise...

freerdp: Out-of-bounds read in general_LumaToYUV444

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the generalLumaToYUV444 function. This Out-Of-Bounds Read occurs because processing is done on the in variable without checking if it...

PT-2024-24761 · Unknown · Loginpress Pro

Name of the Vulnerable Software and Affected Versions: LoginPress Pro versions prior to 3.0.0 Description: The issue is related to an Improper Restriction of Excessive Authentication Attempts, which allows for the removal of important client functionality. Recommendations: For versions prior to...

CVE-2024-32677

Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0...

PT-2024-24762 · Unknown · Loginpress Pro

Name of the Vulnerable Software and Affected Versions: LoginPress Pro versions prior to 3.0.0 Description: The issue is related to a Missing Authorization vulnerability in LoginPress Pro. Recommendations: For versions prior to 3.0.0, update to version 3.0.0 or later to resolve the issue...

PT-2024-3335 · Ruby +7 · Ruby +7

Name of the Vulnerable Software and Affected Versions: Ruby versions 3.0.0 through 3.3.0 Description: The issue is related to a buffer overflow in the heap of the Ruby programming language interpreter. It allows an attacker to impact the confidentiality, integrity, and availability of protected...

CVE-2024-28869

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of...

CVE-2024-28869

Technical details about CVE-2024-28869 are not publicly available in the provided Connected documents. The initial description lists vulnerable Traefik versions and fixes, but no additional technical specifics or exploit information are present here. Monitor for updates.

CVE-2024-31289

Cross-Site Request Forgery CSRF vulnerability in Elementor Hello Elementor.This issue affects Hello Elementor: from n/a through 3.0.0...

Containous Traefik 安全漏洞

Containous Traefik is a reverse proxy and load balancer from Containous Corporation, USA. A security vulnerability exists in Containous Traefik that stems from a Denial of Service DOS vulnerability in the Content-length header. Affected products and versions: Traefik v2.11.0 and earlier, v3.0.0-r...

CVE-2024-2195 Remote Code Execution in aimhubio/aim

A critical Remote Code Execution RCE vulnerability was identified in the aimhubio/aim project, specifically within the /api/runs/search/run/ endpoint, affecting versions = 3.0.0. The vulnerability resides in the runsearchapi function of the aim/web/api/runs/views.py file, where improper restricti...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +138 more potentially affected by CVE-2024-21507 via mysql2 (>=3.0.0, <=3.9.2)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21507 Source advisory: OSV:GHSA-MQR2-W7WJ-JJGR...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +140 more potentially affected by CVE-2024-21509 via mysql2 (>=3.0.0, <=3.9.3)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21509 Source advisory: OSV:GHSA-49J4-86M8-Q2JW...

WordPress Plugin Advanced Classifieds & Directory Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

cassandra-rs's non-idiomatic use of iterators leads to use after free

Impact Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. Code that uses the item and then advances the iterator is unaffected. This problem has always existed...