4966 matches found
CVE-2024-6821
IrfanView CIN File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...
Case Insensitive Input Validation
org.springframework, spring-context is vulnerable to Case Insensitive Input Validation. The vulnerability is due to improper handling of case insensitivity in String.toLowerCase, where the fix for making disallowedFields patterns case insensitive inadvertently introduced a risk. This behavior...
USDA Releases Success Story Detailing the Implementation of Phishing-Resistant Multifactor Authentication
Today, the Cybersecurity and Infrastructure Security Agency CISA and the U.S. Department of Agriculture USDA released Phishing-Resistant Multifactor Authentication MFA Success Story: USDA’s FIDO Implementation. This report details how USDA successfully implemented phishing-resistant authenticatio...
Spring LDAP Spring LDAP sensitive data exposure for case-sensitive comparisons
The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820...
Spring Security Authorization Bypass for Case Sensitive Comparisons
The usage of String.toLowerCase and String.toUpperCase has some Locale dependent exceptions that could potentially result in authorization rules not working properly. Related to CVE-2024-38820...
CVE-2024-9850 SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The SVG Case Study plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...
CVE-2024-9850 SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
The SVG Case Study plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...
Malicious code in sc-case-dispute (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3357583fc362d3c84451a6e68a288423fd4adc4e767eaff6dbbcbb7045a26f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WordPress plugin SVG Case Study 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress...
WordPress SVG Case Study plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin SVG Case Study versions = 1.0...
CVE-2023-0109
creationtimestamp| type| source ---|---|--- 2024-11-15 13:15:35+00:00| seen| https://t.me/cvedetector/11061...
PT-2024-39887 · WordPress · Svg Case Study
Name of the Vulnerable Software and Affected Versions: SVG Case Study plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...
WordPress SVG Case Study Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software SVG Case Study Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9850 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 170c145ba154 Credits Francesco Carlucci Required...
TikTok Pixel Privacy Nightmare: A New Case Study
Advertising on TikTok is the obvious choice for any company trying to reach a young market, and especially so if it happens to be a travel company, with 44% of American Gen Zs saying they use the platform to plan their vacations. But one online travel marketplace targeting young holidaymakers wit...
Path Traversal
Safearchive is vulnerable to a Path Traversal. The vulnerability is due to the handling of archive extractions on case-insensitive filesystems e.g., NTFS, which allows attackers to write arbitrary files by using symbolic links in the archive...
kernel: Bluetooth: btrtl: fix out of bounds memory access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtekdata'. If btrtl driver is used with btusb, then memory for private hci data is...
DEBIAN-CVE-2024-50231
In the Linux kernel, the following vulnerability has been resolved: iio: gts-helper: Fix memory leaks in iiogtsbuildavailscaletable modprobe iio-test-gts and rmmod it, then the following memory leak occurs: unreferenced object 0xffffff80c810be00 size 64: comm "kunittrycatch", pid 1654, jiffies...
mm: avoid leaving partial pfn mappings around in error case
...
Malicious code in case-dispute-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67fde58085d55461a9612067c94598825097d9cf29ac90c5a232a9814f55314b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-50137
creationtimestamp| type| source ---|---|--- 2024-11-05 19:44:18+00:00| seen| https://t.me/cvedetector/9917 2025-04-07 08:44:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10683...