CVE-2022-47411

An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations...

CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps...

The vulnerability of the One Identity Manager’s control mechanism for user identification, access rights, and security policies, related to the insecure direct object reference (IDOR), allows attackers to escalate their privileges.

The vulnerability of the User Identification, Access Rights, and Security Policies management tool, One Identity Manager, is related to an insecure direct reference to an object IDOR due to a bypass of authentication using data that are assumed to be immutable. Exploiting this vulnerability can...

CVE-2025-1010

An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135...

CVE-2025-22936

The CVE-2025-22936 entry affects Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router models SAM-4G1G-TT-W-VC and SAM-4F1F-TT-W-A1. The issue is a weak default WiFi password generation algorithm that could allow a remote attacker to obtain sensitive information. Per available documentation, CVSS ...

CVE-2022-36051

ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...

CVE-2022-27835

Improper boundary check in UWB firmware prior to SMR Apr-2022 Release 1 allows arbitrary memory write...

CVE-2024-38316

CVE-2024-38316 affects IBM Aspera Shares 1.9.0–1.10.0 PL6, where an authenticated user’s ability to send emails is not properly rate-limited, potentially enabling email flooding and denial of service. The IBM Security Bulletin describes the vulnerability (CWE-770: Allocation of Resources Without ...

CVE-2024-57084

A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57065

A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-2650

Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2...

CVE-2022-2540

The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the adminpage function found in the /admin.php file. This makes it possible for unauthenticated...

CVE-2024-57079

creationtimestamp| type| source ---|---|--- 2025-02-05 21:16:22+00:00| seen| https://infosec.exchange/users/cve/statuses/113953353375204676 2025-02-05 22:16:57+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhhlxwf2mq2b 2025-02-06 01:50:54+00:00| seen|...

Security Bulletin: Vulnerability in http-proxy-middleware affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerability in http-proxy-middleware has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-21536 DESCRIPTION:...

CVE-2022-39355

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authentication vulnerability could be used to take control of a victim's forum account. This vulnerability is patched in commit number...

CVE-2017-16272

Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted commands sent through the PubNub service can cause a stack-based buffer overflow overwriting arbitrary data. An attacker...

CVE-2024-31156

creationtimestamp| type| source ---|---|--- 2025-02-05 18:22:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113952669633961882 2025-02-05 21:39:55+00:00| seen| https://t.me/cvedetector/17324...

CVE-2025-24320

creationtimestamp| type| source ---|---|--- 2025-02-05 18:17:08+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh6l46iyi2r 2025-02-05 18:22:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113952669633961882 2025-02-05 18:48:32+00:00| seen|...

CVE-2024-56133

creationtimestamp| type| source ---|---|--- 2025-02-05 18:16:19+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh6jnjorz2f 2025-02-05 18:48:32+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113952771094465939 2025-02-05 22:08:52+00:00| seen|...

CVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping...