PT-2024-32334

Name of the Vulnerable Software and Affected Versions TAKENAKA ENGINEERING CO., LTD. digital video recorders affected versions not specified Description The issue concerns a hidden functionality problem in digital video recorders. This problem allows a remote authenticated attacker to execute an...

CVE-2024-45270

WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress site with Carousel Slider plugin enabled, accessing a crafted page may cause a user to alter the contents of the...

PT-2024-30655 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide affected versions not specified Description: The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometim...

The vulnerability of the alter_form.php function in the Netcat CMS system allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the alterform.php function in the Netcat CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute any JavaScript code in the user’s browser remotely...

kernel: net: kernel: UAF in network route management

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections...

kernel: net: kernel: UAF in network route management

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections...

kernel: net: kernel: UAF in network route management

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections...

CVE-2024-41720

Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device...

Zexeron ZWX-2000CSW2-HN 安全漏洞

The Zexeron ZWX-2000CSW2-HN is a high-speed coaxial modem from Zexeron Japan. A security vulnerability exists in the Zexeron ZWX-2000CSW2-HN prior to version 0.3.15, which stems from the presence of incorrect privilege assignments for critical resource issues, which could allow a network-adjacent...

ClickHouse 安全漏洞

ClickHouse is a ClickHouse open source one of the fastest and most resource efficient open source databases for real-time applications and analytics. A security vulnerability exists in ClickHouse that stems from the ability of an attacker to send a specially crafted request that crashes a server...

WordPress Filter & Grids Plugin <= 2.8.33 is vulnerable to Broken Authentication

Software Filter & Grids Type Plugin Vulnerable versions = 2.8.33 Fixed in 2.8.34 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-39664 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID bac0e0da8bce Credits RE-ALTER Required privileg...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

WordPress Cooked Plugin <= 1.7.15.4 - Authenticated (Contributor+) HTML Injection via Recipe Excerpt vulnerability

Authenticated Contributor+ HTML Injection via Recipe Excerpt vulnerability discovered by RE-ALTER in WordPress Plugin Cooked versions = 1.7.15.4...

WordPress Cooked plugin <= 1.7.15.4 - Multiple Cross Site Request Forgery (CSRF) vulnerability

Multiple Cross Site Request Forgery CSRF vulnerability discovered by RE-ALTER in WordPress Plugin Cooked versions = 1.7.15.4...

PT-2024-5674 · Unknown · Netcat Cms

Name of the Vulnerable Software and Affected Versions: Netcat CMS affected versions not specified Description: The issue is related to a function in the alter form.php file of the Netcat CMS system, which is vulnerable to cross-site request forgery. This could allow a remote attacker to execute...

Prototype Pollution

adolphdudu/ratio-swiper is vulnerable to Prototype Pollution. The vulnerability is due to by passing crafted arguments with the proto property using functions like extendDefaults and parse. The vulnerability allows attackers to alter the behavior of all objects inheriting from the affected...

Prototype Pollution

@cat5th/key-serializer is vulnerable to Prototype Pollution. The vulnerability is due to passing crafted arguments with the proto property using functions like query, set, default.query, and default.set. The vulnerability allows attackers to alter the behavior of all objects inheriting from the...

Prototype Pollution

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to several functions including empty, util.clone, util.prop, util.deep, and make, which can be exploited by passing crafted arguments with the proto property. This allows attackers to alter the behavior of all...

WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by RE-ALTER Patchstack Alliance in WordPress Theme Blocksy versions = 2.0.22...

WordPress Goya theme <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters vulnerability

Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters vulnerability discovered by RE-ALTER in WordPress Theme Goya versions = 1.0.8.7...