CVE-2024-41974 WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices

A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources which may lead to a DoS limited to BACNet communication...

CVE-2024-41974

CVE-2024-41974 affects WAGO BACNet service property modification due to permission misconfiguration across multiple WAGO devices (e.g., PFC100/200, CC100, Edge Controller, TP600 variants). The vulnerability allows a low-privileged remote attacker to modify BACNet service properties, enabling a De...

The vulnerability of the fs.statfs function in the Node.js software platform allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the fs.statfs function in the Node.js software platform is related to the improper assignment of permissions for the critical resource. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information using the...

WordPress Opal Woo Custom Product Variation Plugin <= 1.1.3 is vulnerable to Arbitrary File Deletion

Software Opal Woo Custom Product Variation Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-52444 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID aa758dfd0ef1 Credits...

The vulnerability of the PL/Perl environment in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability in the PL/Perl environment of the PostgreSQL database management system is related to errors in system configuration or settings. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by modifying system environment variables, such as PATH...

CVE-2024-31695

A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding a new fingerprint...

PT-2024-35221 · Unknown · Ai Auto Tool Content Writing Assistant

Name of the Vulnerable Software and Affected Versions: KCT Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions n/a through 2.1.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control...

CVE-2024-31695

A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding a new fingerprint...

Binance 安全漏洞

Binance is a cryptocurrency trading platform from Binance. Binance suffers from a security vulnerability that stems from a misconfiguration of the fingerprint authentication mechanism, which allows an attacker to bypass authentication when adding a new fingerprint...

CVE-2024-31695

CVE-2024-31695 affects Binance’s BTC, Crypto and NFTS v2.85.4. A misconfiguration in the fingerprint authentication mechanism allows bypass when adding a new fingerprint. Documented in multiple feeds (NVD/Red Hat/CNNVD) with a critical CVSS v3.1 score (9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). C...

CVE-2024-31695

A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authentication when adding a new fingerprint...

New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration

Cybersecurity researchers have disclosed new security flaws impacting Citrix Virtual Apps and Desktop that could be exploited to achieve unauthenticated remote code execution RCE The issue, per findings from watchTowr, is rooted in the Session Recording component that allows system administrators...

CVE-2024-44765

An Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality...

CVE-2024-44765

An Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality...

CVE-2024-44765

An Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality...

CVE-2024-44765

CVE-2024-44765 affects MGT-COMMERCE GmbH CloudPanel versions 2.0.0–2.4.2. The root cause is an improper authorization/access control misconfiguration that lets low-privilege users bypass controls and access sensitive configuration files and administrative functionality. Impact is described as pot...

A vulnerability in the configuration of the CI/CD application deployment and continuous integration system JetBrains TeamCity allows a hacker to execute cross-site scripting attacks.

The vulnerability in the configuration of CI/CD system’s backup settings in JetBrains TeamCity exists due to the lack of measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

CVE-2024-48044

Missing Authorization vulnerability in ShortPixel – Convert WebP/AVIF & Optimize Images ShortPixel Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through 5.6.3...

CVE-2024-48039

Missing Authorization vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.15...