Command Injection

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Command Injection via improper neutralization of special elements. An admin attacker can execute arbitrary system commands by leveraging administrative privileges and...

RUSTSEC-2024-0390 minitrace is Unmaintained

The minitrace maintainers have decided to continue the development of minitrace under a new organizational structure to improve community governance. In the meantime, minitrace will no longer be maintained. For more details, refer to tikv/minitrace-rust229. Possible Alternatives fastrace is...

On the Voynich Manuscript

Really interesting article on the ancient-manuscript scholars who are applying their techniques to the Voynich Manuscript. No one has been able to understand the writing yet, but there are some new understandings: Davis presented her findings at the medieval-studies conference and published them ...

.NET 8.0 Update - August 13, 2024 (KB5042132)

None None...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Community Edition CE and Enterprise Edition EE. A malicious party can exploit the vulnerabilities to cause a Denial-of-Service, or to bypass security measures to gain access to projects that the malicious party is not initially authorized to access. GitL...

PT-2024-7210 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.16 through 17.2.9 GitLab CE/EE versions 17.3 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 Description: An issue was discovered in GitLab CE/EE, which allows deploy keys to push to an archived repository. Th...

UBUNTU-CVE-2024-5423

Multiple Denial of Service DoS conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which allowed an attacker to cause resource exhaustion via banzai pipeline...

UBUNTU-CVE-2024-3958

An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into...

PT-2024-5514 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 through 17.0.5 GitLab CE/EE version 17.1 prior to 17.1.4 GitLab CE/EE version 17.2 prior to 17.2.2 Description: The issue is related to an uncontrolled resource consumption in GitLab, a software platform based on gi...

PT-2024-5508 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0 through 17.0.6 GitLab CE/EE versions 17.1 through 17.1.4 GitLab CE/EE versions 17.2 through 17.2.2 Description: A Denial of Service DoS condition has been discovered in GitLab CE/EE, allowing an attacker to cause...

Warehouse Inventory System Cross-Site Request Forgery Vulnerability (CNVD-2024-38221)

Warehouse Inventory System is a warehouse inventory management system for the OSWAPP community. A cross-site request forgery vulnerability exists in Warehouse Inventory System versions 1.0 and 2.0, which can be exploited by an attacker to cause cross-site request forgery...

Introducing the Rapid7 Command Platform

Integrated Security Operations for the Next-Generation Attack Surface As cybercrime and attack surfaces have sprawled, Rapid7 has been able to grow with our customers because we are relentlessly focused on relevance. The way we see it, relevance doesn’t mean aligning to market definitions of...

WordPress Community Events plugin < 1.5.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Community Events versions 1.5.1...

CVE-2024-6270

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6270 Community Events < 1.5.1 - Admin+ Stored XSS

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-6270 Community Events < 1.5.1 - Admin+ Stored XSS

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Community Events 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin...

PT-2024-37498 · WordPress · Community Events

Name of the Vulnerable Software and Affected Versions: Community Events WordPress plugin versions prior to 1.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

WordPress Community Events Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Community Events Type Plugin Vulnerable versions 1.5.1 Fixed in 1.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6270 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 41e2dd4ebfb2 Credits Bob Matyas Required...

Warehouse Inventory System 跨站请求伪造漏洞

Warehouse Inventory System is a warehouse inventory management system for the OSWAPP community. A cross-site request forgery vulnerability exists in Warehouse Inventory System versions 1.0 and 2.0, which can be exploited by an attacker to cause cross-site request forgery...