Canimaan Software LTD ClamXAV 安全漏洞

Canimaan Software LTD ClamXAV is a highly trusted anti-virus and malware scanner for MacOS from Canimaan Software. A security vulnerability exists in Canimaan Software LTD ClamXAV versions v3.1.2 through v3.6.1, which stems from a vulnerability that allows a local attacker to escalate privileges...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

PT-2024-18441 · WordPress · Genesis Blocks

Name of the Vulnerable Software and Affected Versions: Genesis Blocks plugin for WordPress versions up to, and including, 3.1.2 Description: The issue is related to Stored Cross-Site Scripting via the block content due to insufficient input sanitization and output escaping. This allows...

WordPress Genesis Blocks Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Genesis Blocks Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4a98ab741df8 Credits Ngô Thiên An ancorn...

Sunshine Photo Cart < 3.1.2 - Reflected Cross-Site Scripting

Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

PT-2024-23449 · Landing · Landingi Landing Pages

Name of the Vulnerable Software and Affected Versions: Landingi Landing Pages versions n/a through 3.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-20574 · WordPress · Wp Dummy Content Generator

Name of the Vulnerable Software and Affected Versions: WP Dummy Content Generator versions 3.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in the WP Dummy Content Generator plugin for WordPress. This vulnerability allows for a security bypass...

org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0 <=3.1.2), org.apache.pulsar:pulsar-broker-auth-sasl (>=3.1.0 <=3.1.2) +2 more potentially affected by CVE-2024-28098 via org.apache.pulsar:pulsar-broker (>=3.1.0 <=3.1.2)

org.apache.pulsar:pulsar-broker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-28098 Source advisory: OSV:GHSA-G627-R579-RW35...

org.apache.pulsar:pulsar-broker (>=3.1.0 <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0 <=3.1.2) +3 more potentially affected by CVE-2024-27135 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0 <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27135 Source advisory: OSV:GHSA-XP2R-G8QQ-44HH...

CVE-2024-27317 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

HPESBGN04595 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Unauthorized Data Access, Insecure Deserialization; Remote: Disclosure of Sensitive Information, Gain Unauthorized Access, User Validation Failure SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified OSS Console UOC...

BIT-KAFKA-2022-34917 Unauthenticated clients may cause OutOfMemoryError on Apache Kafka Brokers

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Exampl...

CVE-2024-1437

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in José Fernandez Adsmonetizer allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.1.2...

PT-2024-20937 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: The issue allows attackers to run arbitrary system commands via the status parameter, potentially leading to unauthorized access and control. Recommendations: For MRCMS version 3.1.2, avoid using the status...

WordPress ColorMag Theme <= 3.1.2 is vulnerable to Broken Access Control

Software ColorMag Type Theme Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0679 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a03b90ac4c61 Credits Sean Murphy Required privilege...

3di-cmd-client (>=0.0.1a0 <=0.0.3), a-api-server (=1.3.0) +4000 more potentially affected by CVE-2024-22195 via jinja2 (>=2.10.0 <=3.1.2)

jinja2 PYPI version =2.10.0, =0.0.1a0, =0.1.22, =1.0.2, =0.0.2, =3.0.0, =0.0.0, =0.0.1, =0.8.44.4, =0.9.2.1rc2 - actinia-core =4.2.0 and more Source cves: CVE-2024-22195 Source advisory: OSV:GHSA-H5C8-RQWP-CP95...

AZL-35134 CVE-2024-22195 affecting package python-jinja2 for versions less than 3.1.2-2

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...

DeShang DSKMS Access Control Error Vulnerability

DeShang DSKMS is a professional content payment system from DeShang, China. An Access Control Error vulnerability exists in DeShang DSKMS prior to version 3.1.2, which stems from the file public/install.php that results in incorrect access control...

DeShang DSCMS Access Control Error Vulnerability

DeShang DSCMS is a website builder for enterprise websites from DeShang, China. An access control error vulnerability exists in DeShang DSCMS prior to version 3.1.2, which stems from the file public/install.php that causes incorrect access control...

CVE-2023-50082

Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform...