Schneider Electric Software Update < 3.0.12 Privilege Escalation

The version of Schneider Electric Software Update installed on the remote host is prior to 3.0.12. It is, therefore, affected by a link following vulnerability that allows arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruptio...

CVE-2023-25575

API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the security option of the ApiPlatform\Metadata\ApiProperty attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON...

WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module vulnerability

Unauthenticated SQL Injection via Login Attempts Module vulnerability discovered by WordFence in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.12...

PT-2024-33447 · Unknown · Toast Plugins Animator

Name of the Vulnerable Software and Affected Versions: Toast Plugins Animator versions 3.0.11 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Reflected XSS Cross-site Scripting vulnerability. This allows for Reflected...

ModSecurity 安全漏洞

ModSecurity is an open source, cross-platform web application firewall WAF engine from OWASP ModSecurity Open Source. A security vulnerability exists in ModSecurity version v3.0.12 that stems from the inclusion of a buffer overflow issue...

SUSE CVE-2024-1019

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...

DEBIAN-CVE-2024-1019

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...

UBUNTU-CVE-2024-1019

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...

CVE-2024-1019

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2022-25883, CVE-2023-45133)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js...

Tenable Nessus < 10.5.6 Multiple Vulnerabilities (TNS-2023-36)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-36 advisory. - Nessus leverages third-party software to help provide underlying functionality...

OpenSSL Incorrect Cipher Key & IV Length Processing Vulnerability (20231024) - Linux

OpenSSL is prone to an incorrect processing of key and initialisation vector IV lengths vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2023-41944

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the SQS queue...

PT-2023-28181 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue. This can be exploited...

Security Bulletin: IBM Content Navigator is vulnerable to DoS due to Apache Commons FileUpload (CVE-2023-24998)

Summary Apache Commons FileUpload is used by IBM Content Navigator as part of the file upload functionailty. CVE-2023-24998. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of reques...

Jenkins Plugin AWS CodeCommit Trigger 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. Jenkins Plugin A security...

CVE-2023-25789

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Tapfiliate plugin = 3.0.12 versions...

CVE-2022-44582

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Apptivo Apptivo Business Site CRM plugin = 3.0.12 versions...

WordPress Plugin Apptivo Business Site CRM 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...