14389 matches found
CVE-2024-39405
CVE-2024-39405 affects Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier. It is an Improper Authorization (CWE-285) vulnerability that could bypass security features, allowing a low-priv attacker to modify minor information without user interaction. The CVSS 3.1 vector: A...
CVE-2024-38180
Windows SmartScreen Security Feature Bypass Vulnerability...
CVE-2024-38213
CVE-2024-38213 is a Windows Mark of the Web (MoTW) security feature bypass vulnerability. Affected software involves Windows MoTW handling; the flaw allows downloaded web-origin files to bypass warnings/ protections, enabling potentially malicious content to execute. Exploitation information in c...
CVE-2024-38213 Windows Mark of the Web Security Feature Bypass Vulnerability
...
Windows Mark of the Web Security Feature Bypass Vulnerability
...
Windows SmartScreen Security Feature Bypass Vulnerability
...
PT-2024-7101 · Phoenix Contact · Phoenix Contact Charx Sec-3000
Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3000 versions up to 1.6.2 Description: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user user-app t...
PT-2024-5716 · Microsoft · Windows Smartscreen +1
Name of the Vulnerable Software and Affected Versions: Windows SmartScreen affected versions not specified Description: The issue is related to a security feature bypass in the Windows SmartScreen security feature, which can be exploited by a remote attacker to impact the confidentiality,...
APSB24-61 : Security update available for Adobe Commerce
Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, arbitrary file system read, security feature bypass and privilege escalation...
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file...
PT-2024-5548 · Microsoft · Windows
Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The vulnerability is related to a security feature bypass in Microsoft Windows, specifically in the Mark of the Web MoTW mechanism. This allows attackers to bypass SmartScreen...
KLA71485 Multiple vulnerabilities in Microsoft Products (ESU)
Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to spoof user interface, bypass security restrictions, execute arbitrary code, cause denial of service, gain privileges, obtain sensitive information. Below is a...
CVE-2024-27443
An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. A Cross-Site Scripting XSS vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this v...
PT-2024-7557 · Unknown · Jitsi Meet
Name of the Vulnerable Software and Affected Versions: Jitsi Meet versions prior to 2.0.9779 Description: The issue is related to the insecure implementation of the image sharing functionality using giphy in Jitsi Meet. This allows clients to load GIFs from any arbitrary URL if a message from...
CVE-2024-37382
An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafted modification of server configuration...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42355
Shopware is vulnerable to Server-Side Template Injection via the new Twig tag sw_silent_feature_call. The parameter (feature flag name) is not escaped properly, allowing code execution. Affected versions include 6.6.5.0/6.5.x prior to 6.6.5.1 and 6.5.8.13; older 6.2–6.4 can receive protections vi...
Rockwell Automation Logix Controllers Unprotected Alternate Channel (CVE-2024-6242)
A vulnerability exists in the affected products that allows a threat actor to bypass the Trusted Slot feature in a ControlLogix controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device...
