Autodesk AutoCAD 安全漏洞

Autodesk AutoCAD is a suite of professional 3D drawing software from the US-based Autodesk Corporation. Autodesk AutoCAD suffers from a buffer error vulnerability that originates from a memory corruption when parsing a maliciously constructed DWG file, which can be exploited to cause a crash, wri...

CVE-2024-50482: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through = 1.0.0...

CVE-2024-50496 WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through = 6.6...

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Woocommerce Product Design versions = 1.0.0...

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by ghsinfosec Patchstack Alliance in WordPress Plugin Woocommerce Product Design versions = 1.0.0...

GHSA-HXF3-VGPM-FV9P CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Deletion

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-50509 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 072219981f36 Credits ghsinfosec...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-50508 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 6ce68eabacf0 Credits ghsinfosec...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CVE-2024-50611: Improper Control of Generation of Code

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Woocommerce Product Design versions = 1.0.0...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50482 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 410808c7ca79 Credits Bonds Required privilege...

WordPress Bstone Demo Importer Plugin <= 1.0.1 is vulnerable to Privilege Escalation

Software Bstone Demo Importer Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-50481 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 598203db6a42 Credits stealthcopter Required privileg...

PT-2024-10047 · WordPress · Woocommerce Product Design

Name of the Vulnerable Software and Affected Versions: Woocommerce Product Design versions 1.0.0 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a Path Traversal vulnerability. This allows for potential unauthorized...

This Week in Spring - October 22nd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring. I write this to you in an Uber speeding down the autobahn near Frankfurt, Germany. What a time to be alive! At the rate this driver's going, I won't have much time to write this before we've arrived, so let's dive right into...

The vulnerability of Intel Quartus Prime Pro’s automated design system lies in its uncontrolled search path, which allows attackers to escalate their privileges.

The vulnerability of Intel Quartus Prime Pro automated design systems is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow attackers to enhance their privileges...

Malicious code in relativity-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 043c915c6b72dafcfdabeb1d9de218698774737f39d1c0a3a9f14116b2a8eb2a The OpenSSF Package Analysis project identified 'relativity-design-system' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-9419 Malicious code in relativity-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 043c915c6b72dafcfdabeb1d9de218698774737f39d1c0a3a9f14116b2a8eb2a The OpenSSF Package Analysis project identified 'relativity-design-system' @ 1.0.1 npm as malicious. It is considered malicious because: - The...