1114 matches found
SwagPayPal 数据伪造问题漏洞
SwagPayPal is an open source PayPal integration for Shopware, a store software/platform. SwagPayPal suffers from a data forgery issue vulnerability that stems from the fact that the list of amounts and items sent to PayPal may not match those in the created order...
Malicious Package
Overview new-items-card-component is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
CVE-2023-0554
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged reque...
Cross site request forgery (csrf)
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged reque...
CVE-2023-0554 Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged reque...
CVE-2023-23611
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
Softing uaToolkit Embedded 安全漏洞
Softing UaToolkit Embedded is used to support the development of embedded Opc Ua applications via client/server and publisher/subscriber communication by Softing Germany. A security vulnerability exists in Softing uaToolkit Embedded prior to version 1.41, which stems from an incorrectly formatted...
CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation
LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...
Media Library Form API Element - Moderately critical - Information Disclosure - SA-CONTRIB-2023-004
This module enables you to use the media library in custom forms without the Media Library Widget. The module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The...
Shopware 输入验证错误漏洞
Shopware is a suite of open source e-commerce software from German company Shopware. Shopware suffers from an input validation error vulnerability that originates from the ability to use AP to place the same line item into the shopping cart multiple times. This allows users to bypass sales quanti...
CVE-2023-21674
creationtimestamp| type| source ---|---|--- 2023-01-10 21:37:05+00:00| exploited| https://t.me/ctinow/86042 2023-01-11 02:37:31+00:00| exploited| https://t.me/ctinow/86111 2023-01-11 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=943 2023-01-11 12:38:43+00:00| exploited|...
PT-2023-13266 · Unknown · Bluetooth Host
Name of the Vulnerable Software and Affected Versions: Bluetooth HOST affected versions not specified Description: The issue is related to information disclosure due to a buffer over-read in the Bluetooth HOST. This occurs while processing GetFolderItems and GetItemAttribute commands from a peer...
CVE-2021-24942 Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment...
OpenStack 资源管理错误漏洞
OpenStack is a cloud platform management program of the National Aeronautics and Space Administration NASA. A security vulnerability exists in OpenStack openstack-neutron that stems from its uncontrolled resource consumption allowing a remote authenticated user to query a list of security groups...
GHSA-X45C-CVP8-Q4FM Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...
Checking PVS targets for processes with high disk reads
In PVS environments when weak target device performance is encountered, slow boot, slow application opening, there are a several places to check for insights into the source of the problem. One common source ofweak target device performance is an unexpected volume of read requests from target...
CVE-2022-44622
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive...
CVE-2022-44622
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive...
PT-2022-27266 · Jetbrains · Teamcity
Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions 2021.2 through 2022.10 Description: The issue concerns excessive access permissions for secure token health items. Recommendations: For versions 2021.2 through 2022.10, update to a version that addresses the...