mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran

The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...

CVE-2024-25270: Authorization Bypass Through User-Controlled Key

An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference IDOR vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the exposure of sensitive user data...

MAL-2024-8860 Malicious code in color-print12345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a80777a026505265f48975425e0d198263c4cce7bae5200201d7a10c7b329d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-37232

Loftware Spectrum through 4.6 exposes Sensitive Information Logs to an Unauthorized Actor...

USN-6841-2 php7.0, php7.2 vulnerability

USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that PHP could early return in the filtervar function resulting in invalid user information being treated as valid user...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

WordPress plugin PixelYourSite–Your smart PIXEL (TAG) & API Manager 授权问题漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2024-7870: Improper Authentication

The PixelYourSite – Your smart PIXEL TAG & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for...

MAL-2024-8602 Malicious code in @diotoborg/rem-minima (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac8c3c0c15b0999b73c7815d6ba515d2d37f450180559445f1aaa418dfcb404 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8133 Malicious code in @diotoborg/aperiam-cum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb4500021bc56d1007188a6c5a34135cef19214d511bdba545eac3a7fcae98ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8587 Malicious code in @diotoborg/ratione-animi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99fbce442b156c6ca8741c6adc28f303a48f96a03c4ed901e5665e96c520f9d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2024-46310

CVE-2024-46310 POC for CVE-2024-46310 For FXServer version's v...

Exploit for CVE-2024-46310

CVE-2024-46310 POC for CVE-2024-46310 For FXServer version's v...

CVE-2024-7940

The product exposes a service that is intended for local only to all network interfaces without any authentication...

CVE-2024-43444

CVE-2024-43444 involves passwords of agents and customers being displayed in plain text in the OTRS admin log module when certain authentication source configurations are set and debugging for the authentication backend is enabled. Affected products include OTRS 7.0.X (up to 7.0.50), OTRS 8.0.X, ...

WordPress plugin Store Locator Plus 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

PT-2024-31498 · Bytedance · Tiktok

Name of the Vulnerable Software and Affected Versions: TikTok versions prior to 34.5.5 Description: The issue allows the takeover of Lynxview JavaScript interfaces via deeplink traversal in the application's exposed WebView. On Android 12 and later, this is only exploitable by third-party...

GO-2022-1152 Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik

Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik...

PT-2024-29520 · Priority · Priority

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to files or directories being accessible to external parties, which is classified as CWE-552. No further details are provided about...

CVE-2024-42967

Incorrect access control in TOTOLINK LR350 V9.3.5u.6369B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh...