Gitlab -- vulnerabilities

Gitlab reports: Maintainer can leak Dependency Proxy password by changing Dependency Proxy URL via crafted POST request AI feature reads unsanitized content, allowing for attacker to hide prompt injection Project reference can be exposed in system notes...

Telegram Agrees to Share User Data With Authorities for Criminal Investigations

In a major policy reversal, the popular messaging app Telegram has announced it will give users' IP addresses and phone numbers to authorities in response to valid legal requests in an attempt to rein in criminal activity on the platform. "We've made it clear that the IP addresses and phone numbe...

PT-2024-39409 · Stirling Tools · Stirling-Pdf

Name of the Vulnerable Software and Affected Versions: Stirling-Tools Stirling-PDF versions up to 0.28.3 Description: A vulnerability was found in the Markdown-to-PDF component of Stirling-Tools Stirling-PDF, leading to cross-site scripting. The attack can be initiated remotely, with a rather hig...

PT-2024-32093 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions 4.4.0 through 4.7.1 Description: The issue is related to a Directory Traversal vulnerability in the scan folder feature. This vulnerability allows unauthorized access to sensitive files and directories. Recommendations: For eNMS...

PT-2024-32092 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions 4.4.0 through 4.7.1 Description: The issue is related to a Directory Traversal vulnerability. This vulnerability can be exploited through the upload files feature, allowing unauthorized access to sensitive files and directories...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the contact tracking and page hits report feature. An attacker can manipulate web content or hijack user sessions by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerabili...

CVE-2024-31179 Out-of-bounds Read in libfluid_msg library

Out-of-bounds Read vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::TableFeaturePropInstruction::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-31178 Out-of-bounds Read in libfluid_msg library

Out-of-bounds Read vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::TableFeaturePropNextTables::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-31177 Out-of-bounds Read in libfluid_msg library

Out-of-bounds Read vulnerability in Open Networking Foundation ONF libfluid libfluidmsg modules. This vulnerability is associated with program routines fluidmsg::of13::TableFeaturePropActions::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-6641

The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated...

CVE-2024-6641 WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration

The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated...

CVE-2024-6641

The CVE describes a vulnerability in the WordPress plugin WP Hardening – Fix Your WordPress Security, affecting all versions up to 1.2.6. Root cause: an incorrect regular expression in the Stop User Enumeration feature, enabling unauthenticated attackers to bypass security checks and reveal site ...

libfluid security vulnerability

libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::of13::TableFeaturePropInstruction::unpack routine contains an out-of-bounds read vulnerability...

CVE-2024-6641: Incorrect Regular Expression

The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated...

libfluid security vulnerability

libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::of13::TableFeaturePropActions::unpack routine contains an out-of-bounds read vulnerability...

Dockwatch Remote Command Execution Exploit

Dockwatch is a container management web UI for docker. It runs by default without authentication, although guidance is available for how to setup credentials for access. It has a Commands feature that allows a user to run docker commands such as inspect, network, ps. Prior to fix, it did not...

PT-2024-23820 · Open Networking Foundation · Libfluid

Name of the Vulnerable Software and Affected Versions: libfluid version 0.1.0 Description: The issue is an Out-of-bounds Read vulnerability in the Open Networking Foundation ONF libfluid, specifically in the libfluid msg module. It is associated with the program routine fluid...

VulnCheck KEV: CVE-2022-3590

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden...

PT-2024-23818 · Open Networking Foundation · Libfluid

Name of the Vulnerable Software and Affected Versions: libfluid version 0.1.0 Description: The issue is an Out-of-bounds Read vulnerability in the Open Networking Foundation ONF libfluid, specifically in the libfluid msg modules. It is associated with the program routines fluid...

K000141090: SQLite vulnerability CVE-2020-13630

Security Advisory Description ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. CVE-2020-13630 Impact When this vulnerability is exploited, an attacker can cause SQLite to crash, resulting in a denial-of-service DoS, or possibly execu...