CVE-2024-0207

CVE-2024-0207 affects Wireshark 4.2.0, where the HTTP3 dissector crashes, allowing denial of service via packet injection or crafted capture files. Evidence from multiple sources confirms the vulnerability in the HTTP3 parser with DoS impact (CVE-2024-0207). remediation: upgrade to Wireshark 4.2....

CVE-2024-0207

HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file...

CVE-2024-0207

HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file...

PT-2024-6607 · Wireshark +3 · Wireshark +3

Name of the Vulnerable Software and Affected Versions: Wireshark versions 4.2.0 through 4.0.5 Wireshark versions 4.0.0 through 4.0.15 Description: The issue is related to a crash in the SPRT dissector of Wireshark, which can be exploited to cause a denial of service. This can be achieved via pack...

CVE-2023-7171 Novel-Plus Friendly Link FriendLinkController.java cross site scripting

A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulatio...

CVE-2023-7171

CVE-2023-7171 affects Novel-Plus (versions up to 4.2.0) in the Friendly Link Handler, specifically the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java. The issue is a cross-site scripting vulnerability caused by manipulation of an unknown functionality in tha...

Cross site scripting

A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the...

PT-2023-32918 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions up to 4.2.0 Description: A vulnerability was found in the component Friendly Link Handler, specifically in the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java. The manipulation of an...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

OroCommerce Access Control Error Vulnerability

OroCommerce is an open source business-to-business commerce application from Oro. OroCommerce suffers from an Access Control Error vulnerability that stems from insufficient security checks, which allows an attacker to bypass Access Control Lists ACLs. Affected products and versions: OroCommerce...

Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via products

Description The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getproducts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the...

CVE-2023-49213

The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. The fixed versions are 3.10.2, 4.1.10, and 4.2.1...

Ironman Software PowerShell Universal Security Vulnerability

Ironman Software PowerShell Universal is a single pane for managing and delegating access to automation environments from Ironman Software. A security vulnerability exists in Ironman Software PowerShell Universal versions 3.0.0 through 4.2.0, which stems from an invalid filtering of input strings...

Apache RocketMQ 4.2.0 < 4.6.1 Directory Traversal (CVE-2023-37582)

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like ../../../../topic2020 is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal...

CVE-2023-46981

SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list...

CVE-2023-46981

SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list...

12bucks (=0.1.0), 2u-enterprise-data (=10.22.1) +1403 more potentially affected by CVE-2023-41164 via django (>=4.2.0 <=4.2.4)

django PYPI version =4.2.0, =0.7.0, =0.1.6a0, =0.1.0, =1.8.0, =0.1.0a0, =1.0.0, =2.0.0, =2.0.0, =0.0.9, =1.1.0, =0.0.1, =0.11.0 and more Source cves: CVE-2023-41164 Source advisory: OSV:GHSA-7H4P-27MH-HMRW...

PT-2023-29917

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 4.2.0 Description The crypto-js library has a weakened PBKDF2 configuration, which is 1,000 times weaker than originally specified in 1993 and at least 1,300,000 times weaker than the current industry standard. This...

WordPress Popup Builder Plugin < 4.2.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sygnoos:popupbuilder"; if description...

Design/Logic Flaw

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...