CVE-2024-9862

The CVE-2024-9862 entry concerns the Miniorange OTP Verification with Firebase plugin for WordPress. Affects versions up to and including 3.6.0 where user-controlled access to objects and a missing current-password check enable unauthenticated password changes, potentially allowing administrator ...

CVE-2023-7291

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createmollieaccount function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...

CVE-2024-44762

A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts...

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices...

CVE-2024-45275

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices...

CVE-2024-45275 MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected devices...

CVE-2024-45275

CVE-2024-45275 concerns a trust-management vulnerability in Helmholz Rex100 wireless routers where two hard-coded user accounts with fixed passwords enable an unauthenticated remote attacker to gain full control of the device. Public sources in the provided connected documents specify affected de...

PT-2024-31530 · Helmholz +1 · Rex100 +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The devices contain two hard-coded user accounts with hardcoded passwords, allowing an unauthenticated remote attacker to gain full control of the...

GitHub, Telegram Bots, and ASCII QR Codes Abused in New Wave of Phishing Attacks

A new tax-themed malware campaign targeting insurance and finance sectors has been observed leveraging GitHub links in phishing email messages as a way to bypass security measures and deliver Remcos RAT, indicating that the method is gaining traction among threat actors. "In this campaign,...

Google Search user interface: A/B testing shows security concerns remain

For the past few days, Google has been A/B testing some subtle visual changes to its user interface for the search results page. You may only get the new UI for certain types of searches or based on your current geolocation. This test is not to be confused with but could part of a previously...

Social Media Accounts: The Weak Link in Organizational SaaS Security

Social media accounts help shape a brand's identity and reputation. These public forums engage directly with customers as they are a hub to connect, share content and answer questions. However, despite the high profile role these accounts have, many organizations overlook social media account...

The vulnerability of the installation package for microprogramming software in embedded network controllers for building control systems, ASPECT Enterprise, NEXUS Series, MATRIX Series, allows a intruder to gain full control over the device.

The vulnerability of the installation package for microprogramming software in ASPECT Enterprise, NEXUS Series, and MATRIX Series embedded network controllers is related to the use of default account data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full contr...

CVE-2024-8911

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2024-8911 LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2024-32675 · Pomerium +1 · Pomerium +1

Name of the Vulnerable Software and Affected Versions: Pomerium versions prior to 0.27.1 Description: Pomerium is an identity and context-aware access proxy. The Pomerium databroker service manages all persistent Pomerium application state. Requests to the databroker service API are authorized by...

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section which contains multiple fields depending on which transport is selected at that moment. This vulnerability can lead to...

GHSA-J2J9-7PR6-XQWV LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromisin...

GHSA-RWWC-2V8Q-GC9V LibreNMS has Stored Cross-site Scripting vulnerability in "Device Dependencies" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name "hostname" parameter. This vulnerability can lead to the execution of malicious code in the context of other users'...

CVE-2024-46083

Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting XSS. An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user's account on the platform. It is important to note that regular users can trigger...

CVE-2024-8632

creationtimestamp| type| source ---|---|--- 2024-10-01 11:04:07+00:00| seen| https://t.me/cvedetector/6722 2025-02-14 09:47:01+00:00| seen| Telegram/dAvYhubOpXzElRtFl-yD2bAitV-RUZSYg9PYV1Y2nsimJSY...