CVE-2024-0620

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. This makes it possible for unauthenticated attackers to obtain post titles, IDs, slugs as well as other information including for...

CVE-2024-0590

The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the editclarityprojectid function. This makes it possible for unauthenticated attackers to change the project id and add...

Default credentials

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. This makes it possible for unauthenticated attackers to obtain post titles, IDs, slugs as well as other information including for...

CVE-2023-48653

Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery CSRF via ccm/calendar/dialogs/event/delete/submit. An attacker can force an admin to delete events on the site because the event ID is numeric and sequential...

CVE-2020-36778

creationtimestamp| type| source ---|---|--- 2024-02-28 11:11:59+00:00| seen| https://t.me/ctinow/195322 2024-02-29 11:11:44+00:00| seen| https://t.me/ctinow/196508...

Denial Of Service (DOS)

github.com/stacklok/minder is vulnerable to Denial-of-service. The vulnerability due to improper validation of repository IDs during registration. This allows an attacker to register a repository with an invalid or differing upstream ID, causing Minder to inaccurately report the repository as...

SUSE CVE-2021-46937

In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfstargetidswrite' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'targetids' file write callback 'dbgfstargetidswrite', but decreases the...

CVE-2024-26294

creationtimestamp| type| source ---|---|--- 2024-02-27 23:26:35+00:00| seen| https://t.me/ctinow/194940 2024-02-27 23:26:52+00:00| seen| https://t.me/ctinow/194951...

UBUNTU-CVE-2024-26464

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

DEBIAN-CVE-2021-46937

In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfstargetidswrite' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'targetids' file write callback 'dbgfstargetidswrite', but decreases the...

CVE-2021-46937

In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfstargetidswrite' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'targetids' file write callback 'dbgfstargetidswrite', but decreases the...

Minder trusts client-provided mapping from repo name to upstream ID

Summary When using a modified client or the grpc interface directly, the RegisterRepository call accepts both the repository owner / repo and the repoid. Furthermore, these two are not checked for matching before registering webhooks and data in the database. Details It is possible for an attacke...

CVE-2024-27093

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with...

CVE-2024-27081

creationtimestamp| type| source ---|---|--- 2024-02-25 20:06:09+00:00| published-proof-of-concept| https://github.com/esphome/esphome/security/advisories/GHSA-8p25-3q46-8q2p 2024-02-26 18:26:40+00:00| seen| https://t.me/ctinow/193616 2024-02-26 18:32:18+00:00| seen| https://t.me/ctinow/193623...

USN-6650-1 inux-oem-6.1 vulnerability

Zhenghan Wang discovered that the generic ID allocator implementation in the Linux kernel did not properly check for null bitmap when releasing IDs. A local attacker could use this to cause a denial of service system crash...

CVE-2024-1748

creationtimestamp| type| source ---|---|--- 2024-02-22 21:26:11+00:00| seen| https://t.me/ctinow/191182 2024-02-22 21:26:15+00:00| seen| https://t.me/ctinow/191186 2024-03-13 13:36:38+00:00| seen| https://t.me/ctinow/206670...

CVE-2024-22473

creationtimestamp| type| source ---|---|--- 2024-02-21 20:26:15+00:00| seen| https://t.me/ctinow/190032 2024-02-21 20:31:38+00:00| seen| https://t.me/ctinow/190041 2024-02-22 19:36:45+00:00| seen| https://t.me/arpsyndicate/4017 2024-03-13 10:41:11+00:00| seen| https://t.me/ctinow/206539...

CVE-2024-1501

creationtimestamp| type| source ---|---|--- 2024-02-21 05:26:43+00:00| seen| https://t.me/ctinow/189205 2024-02-21 05:26:56+00:00| seen| https://t.me/ctinow/189216 2024-02-22 04:41:54+00:00| seen| https://t.me/arpsyndicate/3942 2024-03-08 17:21:35+00:00| seen| https://t.me/ctinow/203444...

Formidable Registration < 2.12 - Contributor+ Arbitrary User Password Reset To Account Takeover

Description The plugin does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts. PoC 1. ADMIN: Install Formidable Pro plugin 2. ADMIN: Install...

CVE-2024-25407

SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service DoS by using the predicted transaction ID's to terminate other transactions...