WordPress Chartify 2.9.5 Local File Inclusion Vulnerability

CVE-2024-10571 Chartify – WordPress Chart Plugin = 2.9.5 - Unauthenticated Local File Inclusion via source Description The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This make...

Google OAuth Vulnerability Exposes Millions via Failed Startup Domains

New research has pulled back the curtain on a "deficiency" in Google's "Sign in with Google" authentication flow that exploits a quirk in domain ownership to gain access to sensitive data. "Google's OAuth login doesn't protect against someone purchasing a failed startup's domain and using it to...

CVE-2025-23032

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarescala.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts int...

RHEL 8 : Red Hat OpenStack Platform 16.2 (openstack-ironic) (RHSA-2025:0204)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0204 advisory. Ironic is a project which aims to provision bare metal as opposed to virtual machines by leveraging common technologies such as PXE boot and IPMI to...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

CVE-2024-12313 Compare Products for WooCommerce <= 3.2.1 - Unauthenticated PHP Object Injection

The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization of untrusted input from the 'woocomparelist' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No know...

IBM Concert 加密问题漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from an encryption issue vulnerability that stems from a failure to properly enable HTTP Strict Transport Security, which could be...

CVE-2024-12670

A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

PT-2024-12976 · Unknown · Super Socializer

Name of the Vulnerable Software and Affected Versions: Super Socializer versions 7.13 through 7.13.54 Description: The issue involves a broken access control vulnerability, allowing exploitation of incorrectly configured access control security levels. This vulnerability exposes user data to risk...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50096)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50096 advisory. - In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fix vulnerability in...

First Things First: Know and Prioritize Your Risk in Data Security

Fortify your risk posture by shifting focus from network security to data-centric security for more robust cyber defense. Cyberattacks are one of the most onerous threats faced by businesses today. Not only is cybercrime skyrocketing in volume, it is also increasing in AI/ML-powered sophisticatio...

HkCms File Upload Vulnerability in Guangzhou Hengqi Education Technology Co.

HkCms is a free open-source content management system of Guangzhou Hengqi Education Technology Co. Ltd. HkCms file upload vulnerability, the vulnerability stems from a file upload vulnerability in the getFileName method in /app/common/library/Upload.php. The vulnerability can be exploited by an...

The vulnerability of the User Interface component of the application for interacting with customers in Oracle Quoting, a system for automating business operations in the Oracle E-Business Suite. This vulnerability allows an attacker to gain unauthorized access to read, add, modify, or delete data.

The vulnerability of the User Interface component of the application for interacting with customers in Oracle Quoting, a system for automating business operations in the Oracle E-Business Suite, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow ...

PT-2024-33506 · Elvaco · Elvaco

Name of the Vulnerable Software and Affected Versions: Elvaco affected versions not specified Description: The issue arises from insufficiently protected credentials, potentially allowing an attacker to impersonate Elvaco and send false information. Recommendations: At the moment, there is no...

BURG-WCHTER KG de.burgwachter.keyapp.app 安全漏洞

BURG-WCHTER KG de.burgwachter.keyapp.app is a firmware program from BURG-WCHTER KG. A security vulnerability exists in BURG-WCHTER KG de.burgwachter.keyapp.app version 4.5.0, which originated from a problem, that could allow a remote attacker to obtain sensitive information through the firmware...

Exploit for CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribe...

PT-2024-7463

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions 9.8 SP1 FP2 9.8.1.201 and earlier Description: A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab could allow an unauthenticated attacker to conduct a path traversal attack due to...

PT-2024-23497 · Pure Storage · Pure Storage Flasharray

Name of the Vulnerable Software and Affected Versions: PureStorage FlashArray versions up to 6.6.5 Description: A flaw exists in PureStorage FlashArray, allowing a user to make a specific call to a FlashArray endpoint which enables privilege escalation. This issue can lead to improper privilege...

The vulnerability of the mv88e6xxx.default_mdio_bus() function in Marvell 88E6xxx device driver for Linux operating systems allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the mv88e6xxx.defaultmdiobus function in the drivers/net/dsa/mv88e6xxx/chip.c file of the Marvell 88E6xxx device driver in the Linux operating system is related to improper checking of the list. Exploiting this vulnerability could allow an attacker to compromise the integrity...

The vulnerability of the Cisco Duo Epic for Hyperdrive implementation software lies in its lack of adequate protection for operational data, allowing attackers to disclose sensitive information.

The vulnerability of the Cisco Duo Epic for Hyperdrive implementation software lies in the insufficient protection of sensitive data. Exploiting this vulnerability could allow attackers to disclose confidential information...