2470 matches found
CVE-2022-36090
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive not yet activated or disabled users in XWiki, including the REST service. This means a disabled user can enable themselv...
CVE-2024-34360
go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an...
Important: python-virtualenv
Issue Overview: virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287. CVE-2024-53899 Affected Packages: python-virtualenv Issue...
The vulnerability of Python virtualenv’s activation script scenario allows a hacker to execute arbitrary commands.
The vulnerability of Python virtualenv activation scripts is related to the failure to take measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
WordPress Automate Hub Free by Sperse.IO plugin <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update vulnerability
Cross-Site Request Forgery to Activation Status Update vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Automate Hub versions = 1.7.0...
CVE-2024-13683
The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automatehub' page. This makes it possible for unauthenticated attackers to update an...
Important: python3.12
Issue Overview: Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the...
CVE-2024-52328 ECOVACS lawnmowers and vacuums insecurely store audio warning files
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on...
PT-2025-2244 · Sperse.Io · Automate Hub Free
Name of the Vulnerable Software and Affected Versions: Automate Hub Free by Sperse.IO plugin for WordPress versions up to and including 1.7.0 Description: The issue is due to missing or incorrect nonce validation on the 'automate hub' page, making it possible for unauthenticated attackers to upda...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to check that the shadow stack is activated when using the shadow stack, which could result in a...
Social Engineering to Disable iMessage Protections
I am always interested in new phishing tricks, and watching them spread across the ecosystem. A few days ago I started getting phishing SMS messages with a new twist. They were standard messages about delayed packages or somesuch, with the goal of getting me to click on a link and entering some...
CLSA-2025-1736856534 python3.11: Fix of CVE-2024-9287
CVE-2024-9287: Quote path names when creating virtual environments to prevent command injection in activation scripts...
CVE-2024-12006
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and...
CVE-2024-12006 W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and...
WordPress W3 Total Cache plugin <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation vulnerability
WordPress W3 Total Cache plugin = 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation vulnerability discovered by villu164 in WordPress Plugin W3 Total Cache versions = 2.8.1...
iMessage text gets recipient to disable phishing protection so they can be phished
A smishing SMS phishing campaign is targeting iMessage users, attempting to socially engineer them into bypassing Apple's built in phishing protection. For months, iMessage users have been posting examples online of how phishers are trying to get around this protection. And, now, the campign is...
python: Virtual environment (venv) activation scripts don't quote paths
A vulnerability has been found in the Python venv module and CLI. Path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts, for example, "source venv/bin/activate". This flaw allows...
About Authentication Bypass – Hunk Companion WordPress plugin (CVE-2024-11972) vulnerability
About Authentication Bypass - Hunk Companion WordPress plugin CVE-2024-11972 vulnerability. ThemeHunk company develops commercial themes for WordPress CMS. And the Hunk Companion plugin is designed to complement and enhance the functionality of these themes. The plugin has over 10,000...
