Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

...

PT-2024-18935 · Unknown · @Discordjs/Opus

Name of the Vulnerable Software and Affected Versions: @discordjs/opus versions all Description: The issue is related to a Denial of Service DoS condition that can occur when an input object with a toString property is provided to several different functions. This can lead to a system or process...

Palo Alto Networks Expedition Security Breach

Palo Alto Networks Expedition is a tool that helps with configuration migration, tuning and enrichment from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks Expedition that stems from a lack of authentication for critical functionality, causing an attacker with netwo...

node-images Security Vulnerabilities

node-images is a lightweight cross-platform image codec library for Node.js by the individual developer zhangyuanwei. A security vulnerability exists in node-images that stems from providing unexpected input types to multiple different functions, making it susceptible to Denial of Service DoS...

CVE-2024-31327

In multiple functions of MessageQueueBase.h, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-J4R7-P9FP-W3F3 Spring Cloud Function Framework vulnerable to Denial of Service

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Sprin...

Boston Business Journal Names Rapid7 as a Best Place to Work in Boston

On June 13th, 2024, Rapid7 was recognized by The Boston Business Journal as a Best Place to Work in Boston. This marks the 13th consecutive year Rapid7 has made the list, this time coming in at 8 in the extra large company category. Best Places to Work rankings are based on anonymous employee...

CVE-2024-6167

The CVE-2024-6167 issue in the Just Custom Fields WordPress plugin is a missing capability check in several admin AJAX functions, enabling authenticated users with Subscriber-level access (and above) to invoke admin‑only functionality such as managing field groups and item visibility. Affected ve...

WordPress plugin Just Custom Fields security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-37363 · WordPress · Registration Forms

Name of the Vulnerable Software and Affected Versions: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress versions up to, and including, 3.8.3.4 Description: The issue allows authenticated...

CVE-2024-5753 Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna

vanna-ai/vanna version v0.3.4 is vulnerable to SQL injection in some file-critical functions such as pgreadfile. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting the exposed SQL...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387 Proof of Concept PoC Description This rep...

CVE-2023-41918

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918 Missing Authentication for Critical Function in Kiloview P1/P2 devices

A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code...

CVE-2023-41918

CVE-2023-41918 is linked to Kiloview P1/P2 devices. Multiple connected sources describe unauthenticated access to functionality inadequately constrained by ACLs, potentially enabling unauthenticated command execution, data manipulation, or access to privileged functions. Some documents allege bro...

Prototype Pollution

@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...

Prototype Pollution

@jsonic/jsonic-next is vulnerable to Prototype Pollution. The vulnerability is due to several functions including empty, util.clone, util.prop, util.deep, and make, which can be exploited by passing crafted arguments with the proto property. This allows attackers to alter the behavior of all...

Kiloview P1 and P2 Security Vulnerabilities

Kiloview P1 4G Video Encoder and Kiloview P2 4G Video Encoder are both professional video encoder devices from Kiloview China. A security vulnerability exists in the Kiloview P1 and P2. An attacker could exploit the vulnerability to execute unauthenticated commands that could manipulate data,...

Juniper Networks Releases Critical Security Update for Routers

Juniper Networks has released out-of-band security updates to address a critical security flaw that could lead to an authentication bypass in some of its routers. The vulnerability, tracked as CVE-2024-2973, carries a CVSS score of 10.0, indicating maximum severity. "An Authentication Bypass Usin...

Async Security Vulnerabilities

Async is a utility module by the individual developer Caolan McMahon in the UK. It is used for working with asynchronous JavaScript. A security vulnerability exists in Async versions 2.6.4 and earlier and 3.2.5 and earlier, which stems from vulnerability to a Regular Expression Denial of Service...