9656 matches found
CVE-2024-10383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork
An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6,...
Firewall Component DoS
The vulnerability of the MySQL Enterprise Firewall component is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause downtime or service failures using the MySQL network protocol...
CVE-2022-33174
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...
[SECURITY] [DSA 5858-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5858-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 05, 2025 https://www.debian.org/security/faq -...
CVE-2024-30258
FastDDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed RTPS packet, the subscriber crashes when creating pthread. This can remotely crash any Fast-DD...
CVE-2024-6035
A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...
lib/dbi/subscription.c Heap Buffer Overflow DoS
The vulnerability of the ogsdbiauthinfo function lib/dbi/subscription.c, which is used for creating and managing the NR/LTE Open5GS mobile network, is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
CVE-2024-42671
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...
CVE-2024-42671
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...
One policy to rule them all
Windows group policies are a powerful management tool that allows administrators to define and control user and computer settings within a domain environment in a centralized manner. While group policies offer functionality and utility, they are unfortunately a prime target for attackers. In...
CVE-2024-42671
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...
CVE-2024-42671
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...
CVE-2024-42671
The slabiak Appointment Scheduler v.1.0.5 is vulnerable to a Host Header Poisoning Open Redirect issue. This flaw allows a remote attacker to redirect users to a malicious website, which could lead to credential theft , malware distribution , or other malicious activities. The application is a sc...
Fake Reddit and WeTransfer Sites are Pushing Malware
There are thousands of fake Reddit and WeTransfer webpages that are pushing malware. They exploit people who are using search engines to search sites like Reddit. Unsuspecting victims clicking on the link are taken to a fake WeTransfer site that mimicks the interface of the popular file-sharing...
No need to RSVP: a closer look at the Tria stealer campaign
Introduction Since mid-2024, we've observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app APK, which we have named "Tria Stealer" after unique strings found in campaign samples. The primary targets of the...
Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response
The Managed XDR team investigated a sophisticated campaign distributing Lumma Stealer through GitHub, where attackers leveraged the platform's release infrastructure to deliver malware such as SectopRAT, Vidar, and Cobeacon...
Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.3 security updates and bug fixes
Multicluster Engine for Kubernetes 2.7.3 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...
Fastify JavaScript saveRequestFiles DoS
The vulnerability of the saveRequestFiles function in the Fastify JavaScript software framework is related to the use of incorrect authentication tokens due to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending special...
IBM Safer Payments security DoS
The vulnerability of the IBM Safer Payments security tool is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...
Web Runtime SEC DoS
The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management involves unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...