CVE-2024-50258

In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gsomaxsize/gsoipv4maxsize Config a small gsomaxsize/gsoipv4maxsize will lead to an underflow in skdstgsomaxsize, which may trigger a BUGON crash, because sk-skgsomaxsize would be much bigger than...

WordPress plugin WP Feature Box has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-51611: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Peixe WP Feature Box wp-feature-box allows Stored XSS.This issue affects WP Feature Box: from n/a through = 0.1.3...

PT-2024-34754 · Miguel Peixe · Wp Feature Box

Name of the Vulnerable Software and Affected Versions: Miguel Peixe WP Feature Box versions 0.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows attackers to store harmful scripts,...

CVE-2024-51758 Exported files stored in default (`public`) filesystem if not reconfigured in filament

Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the defaultfilesystemdisk config option. This allows the user to easily swap their storage driver to something production-ready like s3 when deploying their...

Firefox Screenshot Data Compromise

The vulnerability in the Firefox web browser’s screenshot creation function is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of data...

MAL-2024-10822 Malicious code in feature-preserve-portrait-editing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 655ca5fa8c26583d141a0d6f86c0bca2e156cbad062d86ff11ec6827d2ac9cf7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

CVE-2024-6861 Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API...

WordPress plugin mFolio Lite: Code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

CVE-2024-6861: Exposure of Sensitive Information to an Unauthorized Actor

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API...

CVE-2024-51516

Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally...

CVE-2024-51516

Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function abnormally...

PT-2024-33516 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.4.04.7 Description: The issue is related to improper authentication in the Private Info feature of Samsung Pass, allowing physical attackers to access sensitive information in a specific scenario...

CVE-2024-9191

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine...

CVE-2024-9191

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine...

OMRON Sysmac Studio security vulnerabilities

Omron Sysmac Studio is a unique environment from Omron Japan that integrates logic, motion and drives, robotics, safety, visualization, sensing, and information technology into a single project, thereby reducing the learning curve and intraoperative software costs. A security vulnerability exists...

WordPress WP Feature Box plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin WP Feature Box versions = 0.1.3...

WordPress WP Feature Box Plugin <= 0.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Feature Box Type Plugin Vulnerable versions = 0.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51611 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cf990022caf8 Credits SOPROBRO Required privilege Contributor...

VulnCheck KEV: CVE-2020-15069

Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x...

AquilaCMS security vulnerabilities

AquilaCMS is a complete multipurpose open source CMS from the AquilaCMS team. A security vulnerability exists in AquilaCMS version 1.409.20 and prior versions that originates from user input that is not adequately validated by the Add a user feature. This allows an unauthenticated attacker to...