CVE-2024-42025

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers Linux with UniFi Network Application Version 8.3.32 and earlier allows a malicious actor with unifi user shell access to escalate privileges to root on the host device...

CVE-2024-42025

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers Linux with UniFi Network Application Version 8.3.32 and earlier allows a malicious actor with unifi user shell access to escalate privileges to root on the host device...

PT-2024-29692 · Ubiquiti · Unifi Network Application

Name of the Vulnerable Software and Affected Versions: UniFi Network Application versions 8.3.32 and earlier Description: A Command Injection issue allows a malicious actor with unifi user shell access to escalate privileges to root on the host device. This issue affects Self-Hosted UniFi Network...

Audiobookshelf 安全漏洞

Audiobookshelf is a self-hosted audiobook and podcast server from Audiobookshelf Open Source. A security vulnerability exists in Audiobookshelf version 2.12.3 and earlier versions. An attacker can exploit the vulnerability to read arbitrary files on the server running the application...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-42056

Retool (self-hosted Enterprise) is affected through versions 3.18.1–3.40.0. The issue arises from inserting resource authentication credentials into sent data, enabling an authenticated attacker with low-privilege permissions (Use) to discover credentials via the /api/resources endpoint. Impact i...

CVE-2024-7208

A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC or SPF or DKIM policies...

CVE-2024-7208 CVE-2024-7208

A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC or SPF or DKIM policies...

CVE-2024-7208 CVE-2024-7208

A vulnerability in multi-tenant hosting allows an authenticated sender to spoof the identity of a shared, hosted domain, thus bypass security measures provided by DMARC or SPF or DKIM policies...

CVE-2024-7208

CVE-2024-7208 describes a vulnerability in multi-tenant hosting where an authenticated sender can spoof the identity of a shared hosting domain, bypassing DMARC, SPF, and DKIM protections. The root cause is inadequate verification of the sender against the domain identities allowed to send on beh...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656

Sentry vulnerability CVE-2024-41656 affects self-hosted Sentry versions 10.0.0 to before 24.7.1, where an unsanitized payload from an Integration platform could store arbitrary HTML that is later rendered on the Issues page. The issue is mitigated for Sentry SaaS (already patched) and on sentry.i...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

Sentry vulnerable to stored Cross-Site Scripting (XSS)

Impact An unsanitized payload sent by an Integration platform integration allows the storage of arbitrary HTML tags on the Sentry side. This payload could subsequently be rendered on the Issues page, creating a Stored Cross-Site Scripting XSS vulnerability. This vulnerability might lead to the...

GHSA-FM88-HC3V-3WWW Sentry vulnerable to stored Cross-Site Scripting (XSS)

Impact An unsanitized payload sent by an Integration platform integration allows the storage of arbitrary HTML tags on the Sentry side. This payload could subsequently be rendered on the Issues page, creating a Stored Cross-Site Scripting XSS vulnerability. This vulnerability might lead to the...

PT-2024-29493 · Unknown · Canarytokens

Name of the Vulnerable Software and Affected Versions: Canarytokens versions prior to sha-8ea5315 Description: Canarytokens help track activity and actions on a network. The Webhook alert feature in Canarytokens.org was vulnerable to a blind Server-Side Request Forgery SSRF prior to sha-8ea5315...