CVE-2024-40746 Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

A stored cross-site scripting XSS vulnerability in HikaShop Joomla Component 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the description parameter of any product. The description parameter is not sanitised in the...

CVE-2024-40746

CVE-2024-40746 is a stored XSS affecting the Hikashop Joomla component prior to 5.1.1. The root cause is that the description parameter in a product is not sanitized in the backend, enabling a remote attacker to inject arbitrary JavaScript into a user’s browser. Affected software: Hikashop Joomla...

CVE-2024-40746 Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

A stored cross-site scripting XSS vulnerability in HikaShop Joomla Component 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the description parameter of any product. The description parameter is not sanitised in the...

curl: When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly

Vulnerability description not provided...

CVE-2024-45944

In J2eeFAST =2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution...

CVE-2024-45944

In J2eeFAST =2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution...

OESA-2024-2280 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with ...

PT-2024-31853 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2eeFAST versions =2.7 Description: The issue is related to unsafe filtering in the backend function, which allows an attacker to trigger certain sensitive functions, resulting in arbitrary code execution. Recommendations: For J2eeFAST versio...

CVE-2024-10101 Stored XSS in binary-husky/gpt_academic

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101 Stored XSS in binary-husky/gpt_academic

A stored cross-site scripting XSS vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payloa...

CVE-2024-10101

CVE-2024-10101 concerns a stored XSS in binary-husky/gpt_academic v3.83, occurring at the /file endpoint which renders HTML files. Malicious HTML uploads stored on the backend can trigger payload execution in a victim’s browser when the file is accessed, potentially exposing session cookies or ot...

Input Validation

typo3/cms-backend is vulnerable to Input Validation. The vulnerability is due to a lack of proper validation checks on user input, allowing for the manipulation of data saved in the bookmark toolbar and triggering errors that disrupt access to the backend user interface...

PT-2024-31606

Name of the Vulnerable Software and Affected Versions: Picotls versions prior to the latest release Description: The issue arises when parsing a spoofed TLS handshake message, causing picotls to attempt to free the same memory twice. This double free occurs during the disposal of multiple objects...

CVE-2024-47870

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

CVE-2024-47870

CVE-2024-47870 is a race condition in Gradio’s update_root_in_config function that lets an attacker modify the frontend-backend root URL, enabling redirection of user traffic to a malicious server. This can lead to interception of sensitive data (e.g., credentials, uploaded files) for users conne...

Gradio has a race condition in update_root_in_config may redirect user traffic

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect use...

GHSA-XH2X-3MRM-FWQM Gradio has a race condition in update_root_in_config may redirect user traffic

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect use...

Vault Operators in Root Namespace May Elevate Their Privileges

Summary A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. This vulnerability, identified as CVE-2024-9180, is fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18....

MAL-2024-9128 Malicious code in backend-engineering-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba3d379889155c3bbca462ca410261268a1d3a1a0d824d8108c2e4a9a225e8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in backend-engineering-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba3d379889155c3bbca462ca410261268a1d3a1a0d824d8108c2e4a9a225e8b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...