Log Injection

io.quarkiverse.cxf, quarkus-cxf is vulnerable to Log Injection. The vulnerability is due to misconfiguration of logging settings, which results in passwords and other secrets being logged; specific configurations, such as enabled SOAP logging and access to application logs, allow attackers to...

WordPress Leyka Plugin <=3.31.6 is vulnerable to Full Path Disclosure (FPD)

Software Leyka Type Plugin Vulnerable versions =3.31.6 Fixed in 3.31.7 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-49252 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 27d1979f75bc Credits Trương Hữu Phúc truonghuuphuc...

WordPress WPIDE – File Manager & Code Editor Plugin <= 3.4.9 is vulnerable to Full Path Disclosure (FPD)

Software WPIDE – File Manager & Code Editor Type Plugin Vulnerable versions = 3.4.9 Fixed in 3.5.0 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-9546 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 611d26fe2e96 Credits TANG...

openssl: SSL_select_next_proto buffer overread

A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSLselectnextproto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called...

PHP 操作系统命令注入漏洞

PHP is a scripting language for PHP that executes on the server side. A security vulnerability exists in PHP versions prior to 8.1.29, prior to 8.2.20, and prior to 8.3.8, which stems from a misconfiguration when using a Windows code page with a non-standard configuration that points to the OEM...

CVE-2024-9417

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are...

WordPress plugin Hash Form 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

CVE-2024-9410 Ada.cx SSRF via Sentry Misconfiguration

Ada.cx's Sentry configuration allowed for blind server-side request forgeries SSRF through the use of a data scraping endpoint...

CVE-2024-9410 Ada.cx SSRF via Sentry Misconfiguration

Ada.cx's Sentry configuration allowed for blind server-side request forgeries SSRF through the use of a data scraping endpoint...

HCL Nomad 安全漏洞

HCL Nomad is an application from HCL USA for using and managing the Domino application development platform in mobile devices. A security vulnerability exists in HCL Nomad that stems from the default failure to configure certain HTTP security headers on Domino, which could allow an attacker to...

The vulnerability of the mod_jk module of the Apache Tomcat JK Connector allows attackers to disclose sensitive information or cause service failures.

The vulnerability of the JkShmFile directive in the modjk module of the Apache Tomcat JK Connector is related to the incorrect use of standard permissions. Exploiting this vulnerability can allow an attacker to disclose information about the modjk module or cause service failures...

SUSE CVE-2024-8118

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules...

CVE-2024-9160

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-9160 Security Misconfiguration in Forge module PEADM

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-9160 Security Misconfiguration in Forge module PEADM

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-9160

The CVE-2024-9160 entry concerns the PEADM Forge Module, where versions prior to 3.24.0 are affected by a security misconfiguration. Multiple connected sources confirm the vulnerable scope is before 3.24.0 and recommend upgrading to 3.24.0 or later as the fix. No exploit details are provided in t...

PT-2024-39462 · Unknown · Peadm Forge Module

Name of the Vulnerable Software and Affected Versions: PEADM Forge Module versions prior to 3.24.0 Description: A security misconfiguration was discovered in the software. Recommendations: For versions prior to 3.24.0, update to version 3.24.0 or later to resolve the issue...

Puppet Enterprise Administration Module 安全漏洞

Puppet Enterprise Administration Module PEADM is an open source Puppet module from Puppet that defines the Bolt program. It is used to automate Puppet Enterprise deployments. A security vulnerability exists in Puppet Enterprise Administration Module versions prior to 3.24.0 that stems from the...

UBUNTU-CVE-2024-8118

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules...

PT-2024-31393 · Ory · Ory Kratos

Name of the Vulnerable Software and Affected Versions: Ory Kratos versions prior to 1.3.0 Description: Ory Kratos is an identity, user management, and authentication system for cloud services. The highest available setting incorrectly assumes the identity's highest available Authenticator Assuran...