PT-2024-28100 · Qnap · Qnap Ai Core

Name of the Vulnerable Software and Affected Versions: QNAP AI Core versions prior to 3.4.1 Description: An exposure of sensitive information issue has been reported, potentially allowing remote attackers to compromise the system's security. Recommendations: For QNAP AI Core versions prior to...

CVE-2024-51756 cap-std doesn't fully sandbox all the Windows device filenames

The cap-std project is organized around the eponymous cap-std crate, and develops libraries to make it easy to write capability-based code. cap-std's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however i...

cap-primitives doesn't fully sandbox all the Windows device filenames

Impact cap-primitives's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", a...

cap-std 路径遍历漏洞

cap-std is a feature-based version of the Rust Standard Library open-sourced by the Bytecode Alliance. A path traversal vulnerability exists in versions of cap-std prior to 3.4.1, which stems from a failure of the file system sandbox implementation on Windows to prevent access to special device...

KubeSphere 安全漏洞

KubeSphere is KubeSphere open source a distributed operating system built on top of Kubernetes for cloud-native applications. A security vulnerability exists in KubeSphere version v3.4.1 and v4.1.1. An attacker can exploit the vulnerability to access sensitive resources...

TVT NVMS-1000 Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TVT NVMS-1000 Directory Traversal', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability which exists in...

WordPress Visual Composer Starter Theme <= 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Visual Composer Starter Type Theme Vulnerable versions = 3.3 Fixed in 3.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43263 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ce7f81ff359f Credits stealthcopter Required privilege...

CVE-2024-38446

NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user without their consent or knowledge via a modified UUID in a POST request...

Vulnerable embedded jQuery Version

Summary PIMCore uses the JavaScript library jQuery in version 3.4.1. This version is vulnerable to cross-site-scripting XSS. Details In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it to one of...

Oracle Linux 8 : git-lfs (ELSA-2024-3346)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3346 advisory. 3.4.1-2 - Rebuild with new Golang - Resolves: RHEL-32543, RHEL-28377, RHEL-28399, RHEL-28423 3.4.1-1 - Update to version 3.4.1 - Resolves: RHEL-17102...

PT-2024-11992 · Oceanwp · Oceanwp

Name of the Vulnerable Software and Affected Versions: OceanWP versions 3.4.1 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows PHP Local File Inclusion in OceanWP. This...

WordPress plugin OceanWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

eZ Platform Bundled jQuery affected by CVE-2019-11358

In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your...

PT-2024-24425 · Paystack · Payment Forms For Paystack

Name of the Vulnerable Software and Affected Versions: Paystack Payment Forms for Paystack versions 3.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker...

CVE-2024-0873

The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-0873 Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WordPress Plugin Watu Quiz 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

PT-2024-15882 · WordPress · Watu Quiz

Name of the Vulnerable Software and Affected Versions: Watu Quiz plugin for WordPress versions up to, and including, 3.4.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'watu-basic-chart' shortcode due to insufficient input sanitization and output escaping on...

WordPress Watu Quiz plugin <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Watu Quiz versions = 3.4.1...

WordPress Watu Quiz plugin <= 3.4.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin Watu Quiz versions = 3.4.1...