CVE-2024-32947

CVE-2024-32947 is a Cross-Site Request Forgery (CSRF) vulnerability in WP ADA Compliance Check Basic (AlumniOnline Web Services LLC) for WordPress, affecting versions up to 3.1.3. The CVSS base score is 4.3 (Medium); attack vector is network with user interaction required. The available documents...

CVE-2024-32947: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3...

PT-2024-24994

Name of the Vulnerable Software and Affected Versions WP ADA Compliance Check Basic versions 3.1.3 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application tha...

CVE-2023-48763: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4...

WordPress plugin WP ADA Compliance Check Basic: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-31463

Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the IRONICREVERSEPROXYSETUP variable set to true, 1 HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2...

CVE-2024-31463

The CVE-2024-31463 entry concerns Ironic-image in reverse proxy mode. When IRONIC_REVERSE_PROXY_SETUP is true, HTTP basic creds are validated in the HTTPD container and Ironic listens on a private port (6388) on localhost, enabling unauthenticated access to the Ironic API for pods/local users on ...

Kohya_ss security vulnerabilities

Kohya is a repository for bmaltais individual developers. A security vulnerability exists in Kohyass versions v22.6.1 through v23.1.3, which stems from a command injection vulnerability in basicoptiongui.py...

PT-2024-24360

Name of the Vulnerable Software and Affected Versions Kohya ss versions prior to 23.1.5 Description Kohya ss, a GUI for Kohya's Stable Diffusion trainers, is vulnerable to command injection in the basic caption gui.py file. Recommendations For versions prior to 23.1.5, update to version 23.1.5 to...

Calendarista Basic Edition < 3.0.3 - Cross-Site Request Forgery

Description The Calendarista Basic Edition plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.2. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform...

CVE-2024-31942

Cross-Site Request Forgery CSRF vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

CVE-2024-31942

Calendarista Basic Edition (WordPress) is affected by a Cross-Site Request Forgery (CSRF) vulnerability for Calendarista Booking actions in versions up to 3.0.2. The issue is confirmed as fixed (Patched) in a newer release; upgrade to a patched version when available. If upgrading is not possible...

CVE-2024-31942 WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

HP UEFI Privilege Escalation

The vulnerability of HP workstation BIOS microprogramming software is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to enhance their privileges, execute arbitrary code, or cause service failures...

CVE-2024-32489: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

TCPDF before 6.7.4 mishandles calls that use HTML syntax...

CVE-2024-31942: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

Apache Solr Operator liveness and readiness probes may leak basic auth credentials

Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for...

CVE-2024-31391 Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials

Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for...

PT-2024-24039

Name of the Vulnerable Software and Affected Versions Apache Solr Operator versions 0.3.0 through 0.8.0 Description The issue affects the Apache Solr Operator when bootstrapping Solr security, enabling basic authentication, and creating accounts for accessing Solr. The operator uses a "k8s-oper"...

Apache Solr Operator log information leakage vulnerability

Apache Solr is a search server based on Lucene a full-text search engine from the Apache Foundation. The product supports hierarchical search, vertical search, highlighting of search results, and more. A log information disclosure vulnerability exists in Apache Solr Operator versions 0.3.0 throug...