CVE-2023-34387

CVE-2023-34387 concerns the WordPress plugin Constant Contact Forms (versions ≤ 2.0.3). The issue is a Missing Authorization vulnerability, specifically related to an improperly protected access point (constant_contact_optin_ajax_handler) that could allow bypassing authorization checks. The CVE i...

PT-2024-36228 · Unknown · Connect Contact Form 7 To Constant Contact

Name of the Vulnerable Software and Affected Versions: Connect Contact Form 7 to Constant Contact versions 1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is...

WordPress plugin Connect Contact Form 7 to Constant Contact 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2023-34387: Missing Authorization

Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3...

WordPress plugin Constant Contact Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2024-54343: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thehowarde Connect Contact Form 7 to Constant Contact connect-contact-form-7-to-constant-contact-v3 allows Reflected XSS.This issue affects Connect Contact Form 7 to Constant Contact: from n/a...

Medium: avahi

Issue Overview: avahi: Avahi Wide-Area DNS Uses Constant Source Port CVE-2024-52615 avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Affected Packages: avahi Issue Correction: Run dnf update avahi --releasever 2023.6.20241212 or dnf update --advisory ALAS2023-2024-771...

Medium: avahi

Issue Overview: avahi: Avahi Wide-Area DNS Uses Constant Source Port CVE-2024-52615 avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Affected Packages: avahi Issue Correction: Run dnf update avahi --releasever 2023.6.20241212 to update your system. New Packages: aarch64: ...

CVE-2024-53845 AES/CBC Constant IV Vulnerability in ESPTouch v2

ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV Initialization Vector prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant...

WordPress Connect Contact Form 7 to Constant Contact plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Connect Contact Form 7 to Constant Contact versions = 1.4...

PT-2024-35948

Name of the Vulnerable Software and Affected Versions: ESPTouch versions prior to 5.3.2 ESPTouch versions prior to 5.2.4 ESPTouch versions prior to 5.1.6 ESPTouch versions prior to 5.0.8 Description: ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, the...

PT-2024-17301 · Devolutions · Devolutions.Xts.Net

Name of the Vulnerable Software and Affected Versions: Devolutions.XTS.NET versions 2024.11.19 and earlier Description: The issue concerns a non-constant time cryptographic operation, which can be exploited via timing attacks. This allows an attacker to render half of the encryption key obsolete...

CVE-2024-11862: Covert Timing Channel

Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption key obsolete via a timing attacks...

CVE-2024-52307

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

CVE-2024-52307: Observable Timing Discrepancy

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ endpoint it was possible to brute-force the SECRETKEY, which is used to authenticate the endpoint. The /-/metrics/ endpoint returns Prometheus metrics and is not intended to be...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

SUSE CVE-2024-50270

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damonfeedloopnextinput damonfeedloopnextinput is inefficient and fragile to overflows. Specifically, 'scoregoaldiffbp' calculation can overflow when 'score' is high. The calculation is actually...

UBUNTU-CVE-2024-50270

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damonfeedloopnextinput damonfeedloopnextinput is inefficient and fragile to overflows. Specifically, 'scoregoaldiffbp' calculation can overflow when 'score' is high. The calculation is actually...

CVE-2024-50270

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid overflow in damonfeedloopnextinput damonfeedloopnextinput is inefficient and fragile to overflows. Specifically, 'scoregoaldiffbp' calculation can overflow when 'score' is high. The calculation is actually...