CVE-2023-31073

Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and User Profile Fields: from n/a through...

CVE-2023-31073

Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields shortcode-to-display-post-and-user-data allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and...

PT-2024-12259 · Unknown · Display Custom Fields In The Frontend – Post/User Profile Fields

Name of the Vulnerable Software and Affected Versions: Display custom fields in the frontend – Post and User Profile Fields versions 1.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security...

Doctor-Appointment 安全漏洞

Doctor-Appointment is a doctor's appointment system by Divyanshu Sharma Personal Developer. A security vulnerability exists in Doctor-Appointment version 1.0, which stems from /Frontend/signupcom.php containing an arbitrary file upload vulnerability...

Malicious code in agilent.pl29.voldemort.frontend (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11294 Malicious code in agilent.pl29.voldemort.frontend (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @conundra/components-frontend (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-17008 · WordPress · Feedpress Generator – External Rss Frontend Customizer

Name of the Vulnerable Software and Affected Versions: Feedpress Generator – External RSS Frontend Customizer plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization...

Exploit for CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on...

Vulnerabilities fixed in Zabbix

Zabbix has fixed vulnerabilities in the Zabbix server and frontend. The vulnerabilities include a stack buffer overflow in the zbxsnmpcachehandleengineid function, which can lead to execution of arbitrary code or a denial of service. In addition, there is an SQL injection vulnerability that allow...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used

A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-42327 SQL injection in user.get API

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...

CVE-2024-42327

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...

CVE-2024-42327

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...

CVE-2024-42327

CVE-2024-42327 is an authenticated SQL injection in Zabbix via the user.get path (CUser.addRelatedObjects) exploitable by non-admin/API-access users. Public PoCs show time-based SQLi leakage of user data and, in some variants, admin API tokens and RCE sequences, enabling privilege escalation to Z...

Malicious code in opendevin-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cef774221fcc201d7233921a587ac24de3a810c28e006c75513c79b54b9999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11060 Malicious code in opendevin-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cef774221fcc201d7233921a587ac24de3a810c28e006c75513c79b54b9999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10981 Malicious code in isc-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in isc-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...