CVE-2024-50407

Namaste! LMS (Namaste! LMS by Kiboko Labs) contains a Reflected XSS in versions up to 2.6.2 caused by improper input neutralization during web page generation. CVE-2024-50407 documents an XSS vulnerability with CVSS v3.1 base score 7.1 (HIGH) [attack vector: network; user interaction: required]. ...

CVE-2024-50409 WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through = 2.6.2...

CVE-2024-50409

CVE-2024-50409 – Namaste! LMS (WordPress) Stored XSS . Affected versions: Namaste! LMS up to 2.6.2. The issue stems from improper neutralization of input during web page generation, enabling stored XSS. The vulnerability is documented in Patchstack and CVE records, and Patchstack notes that the f...

CVE-2024-50410

Namaste! LMS (WordPress plugin) contains a stored XSS vulnerability (CVE-2024-50410) due to improper input neutralization during web page generation. Affected versions are up to 2.6.4; patch 2.6.4.1 fixes the issue. Patchstack and CVE records confirm the fix and vulnerability details. If upgradin...

CVE-2024-50410 WordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through = 2.6.4...

CVE-2024-50408

Deserialization of Untrusted Data vulnerability in Kiboko Labs Namaste! LMS allows Object Injection.This issue affects Namaste! LMS: from n/a through 2.6.3...

CVE-2024-50408

Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through = 2.6.3...

CVE-2024-50408 WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through = 2.6.3...

CVE-2024-50408 WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through = 2.6.3...

CVE-2024-50408

CVE-2024-50408 concerns Namaste! LMS for WordPress. The Namaste! LMS plugin, versions n/a through 2.6.3, is affected by a PHP Object Injection vulnerability due to unsafe deserialization of untrusted data, enabling object injection. This entry is corroborated by Patchstack, Red Hat, CVE records, ...

AWS VDP: A potential risk in the cloudFrontExtensionsConsole which can be used to privilege escalation.

A potential risk was found in the cloudFrontExtensionsConsole when it was deployed in the awslabs repository on GitHub. The functions created by the application had excessive permissions that could be leveraged to escalate privileges...

CVE-2024-49311

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WisdmLabs Edwiser Bridge allows Stored XSS.This issue affects Edwiser Bridge: from n/a through 3.0.7...

Amazon Linux 2 : unbound (ALAS-2024-2650)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2650 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that i...

CloudGoat: New Scenario and Walkthrough (sns_secrets)

The post CloudGoat: New Scenario and Walkthrough snssecrets appeared first on Rhino Security Labs...

Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2024-003)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2024-003 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large...

Amazon Linux 2 : unbound (ALASUNBOUND-2024-003)

The version of unbound installed on the remote host is prior to 1.13.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-2024-003 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets...

CVE-2024-48795

An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process...

Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration

A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance CSA as zero-days to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain...

CVE-2024-48795

The CVE-2024-48795 entry concerns Creative Labs com.creative.apps.xficonnect 2.00.02, where a flaw in the firmware update process could allow a remote attacker to obtain sensitive information. Affected component: com.creative.apps.xficonnect runtime/firmware update flow. Underlying cause and exac...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-719)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-719 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses...