CVE-2024-39904 Code Execution Vulnerability via Local File Path Traversal in Vnote

VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example,...

PHP Vulnerability Exploited to Spread Malware and Launch DDoS Attacks

Multiple threat actors have been observed exploiting a recently disclosed security flaw in PHP to deliver remote access trojans, cryptocurrency miners, and distributed denial-of-service DDoS botnets. The vulnerability in question is CVE-2024-4577 CVSS score: 9.8, which allows an attacker to...

WordPress JSON Content Importer Plugin <= 1.5.6 is vulnerable to Server Side Request Forgery (SSRF)

Software JSON Content Importer Type Plugin Vulnerable versions = 1.5.6 Fixed in 1.6.0 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-38723 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID f916d2cf2c68 Credits...

Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited

Microsoft has released patches to address a total of 143 security flaws as part of its monthly security updates, two of which have come under active exploitation in the wild. Five out of the 143 flaws are rated Critical, 136 are rated Important, and four are rated Moderate in severity. The fixes...

CVE-2024-36450

Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may b...

WordPress Team Members Plugin <= 5.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Team Members Type Plugin Vulnerable versions = 5.3.3 Fixed in 5.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38670 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f0e47f407025 Credits Jean Tirstan T Required privilege...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-23692 Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2024-38080 Microsoft Windows Hyper-V...

Microsoft Azure DevOps Server Security Vulnerability

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as code sharing, work tracking, and software distribution. A security vulnerability exists in Microsoft Azure DevOps Server. An attacker exploits...

CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the...

CVE-2024-36991

creationtimestamp| type| source ---|---|--- 2024-07-06 00:54:38+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7885 2024-07-06 07:49:45+00:00| published-proof-of-concept| https://t.me/proxybar/2152 2024-07-06 11:33:13+00:00| published-proof-of-concept| https://t.me/lostsec/756...

CVE-2024-36401

creationtimestamp| type| source ---|---|--- 2024-07-03 15:43:33+00:00| published-proof-of-concept| https://t.me/HackingInsights/4617 2024-07-04 13:46:58+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7863 2024-07-04 16:31:10+00:00| published-proof-of-concept|...

WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Backdoor

Software alfred24 Click & Collect Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cf5f2b39e0cf Credits Sansec.io Required privilege Unauthenticated Published 3...

Prototype Pollution

@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

CVE-2024-37905

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...

WordPress Slider Revolution Plugin <= 6.7.13 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.7.13 Fixed in 6.7.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37449 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 0c45389d2eaa Credits wcraft Required privilege Administrator...