Malicious code in nespresso-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4df4d16cd100a965fef42c58150e9688849a5acfa8de2f809b3ed66f5ef9f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Site Reviews Plugin < 7.0.0 is vulnerable to Bypass Vulnerability

Software Site Reviews Type Plugin Vulnerable versions 7.0.0 Fixed in 7.0.0 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-3050 Patch priority Low CVSS severity Low 5.3 Developer Gemini Labs PSID f2c354c46a11 Credits Sławomir Zakrzewski Maksymilian Kubiak AFINE...

QNAP QuTS hero < 5.2.0 Log Spoofing Vulnerability

QNAP QuTS hero is prone to a log spoofing vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero";...

Fedora: Security Advisory (FEDORA-2024-2ec03ca8cb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AJ-Report SQL注入漏洞

AJ-Report is anji-plus open source a completely open source , drag and drop editing visual design tools. AJ-Report 1.4.1 and earlier versions of SQL injection vulnerability , there is no detailed vulnerability details provided...

The vulnerability of Siemens Solid Edge’s design and simulation tools relates to reading data beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Siemens Solid Edge’s design and simulation tools relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created PAR file...

MAL-2024-1368 Malicious code in brand-adidas-design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e16fae72fd3726263d7bfa2f1c164b7d4100f89931856c163e37c534feb1a57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-31232

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1...

CVE-2024-31231

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1...

CVE-2024-31232

The CVE-2024-31232 issue affects the WordPress plugin/theme Rehub (Sizam Design) and is a Path Traversal vulnerability: Improperly limited pathname allows PHP Local File Inclusion. Affected versions are Rehub up to 19.6.1 (including Rehub theme). Root cause, as described in the sources, is an una...

CVE-2024-31232 WordPress Rehub theme <= 19.6.1 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1...

CVE-2024-31231 WordPress Rehub theme <= 19.6.1 - Unauthenticated Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Sizam Design Rehub allows PHP Local File Inclusion.This issue affects Rehub: from n/a through 19.6.1...

CVE-2024-31231

CVE-2024-31231 affects the WordPress Rehub theme (

CVE-2024-21777

Uncontrolled search path in some IntelR QuartusR Prime Pro Edition Design software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-4609

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in...

CVE-2024-4609 Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability

A vulnerability exists in the Rockwell Automation FactoryTalk® View SE Datalog function that could allow a threat actor to inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. If exploited, the attack could result in...

PT-2024-3630 · Rockwell Automation · Factorytalk View Se

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk View SE Datalog function Description: A threat actor could inject a malicious SQL statement if the SQL database has no authentication in place or if legitimate credentials were stolen. This could result in...

CISA and Partners Release Guidance for Civil Society Organizations on Mitigating Cyber Threats with Limited Resources

CISA, in partnership with the Department of Homeland Security DHS, the Federal Bureau of Investigation FBI and international partners, released Mitigating Cyber Threats with Limited Resources: Guidance for Civil Society. The joint guidance provides civil society organizations and individuals with...

MITRE Unveils EMB3D: A Threat-Modeling Framework for Embedded Devices

The MITRE Corporation has officially made available a new threat-modeling framework called EMB3D for makers of embedded devices used in critical infrastructure environments. "The model provides a cultivated knowledge base of cyber threats to embedded devices, providing a common understanding of...

ASD’s ACSC, CISA, and Partners Release Secure by Design Guidance on Choosing Secure and Verifiable Technologies

Today, the Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC, together with CISA, the Canadian Centre for Cyber Security CCCS, the United Kingdom’s National Cyber Security Centre NCSC-UK, and the New Zealand National Cyber Security Centre NCSC-NZ are releasing the...