GHSA-XGQ9-7GW6-JR5R Mattermost Desktop App fails to sufficiently configure Electron Fuses

Mattermost Desktop App versions =5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access...

WordPress Maintenance Redirect Plugin <= 2.0.1 is vulnerable to Bypass Vulnerability

Software Maintenance Redirect Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.1.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-45453 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID c6be411efef1 Credits LeNgocHoa Required...

TECNO com.afmobi.boomplayer 安全漏洞

TECNO com.afmobi.boomplayer is a mobile application from TECNO China. A security vulnerability exists in TECNO com.afmobi.boomplayer, which stems from a misconfiguration of permissions, leading to account takeover...

WordPress Custom Post Limits Plugin <= 4.4.1 is vulnerable to Full Path Disclosure (FPD)

Software Custom Post Limits Type Plugin Vulnerable versions = 4.4.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6544 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 71ab81c6724d Credits stealthcopter Required...

Exploit for Code Injection in Mjml Mjml_App

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024...

GO-2024-3087 Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor

Casdoor CORS misconfiguration GHSL-2024-035 in github.com/casdoor/casdoor...

GO-2024-3088 memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

memos CORS Misconfiguration in server.go GHSL-2024-034 in github.com/usememos/memos...

Privilege Escalation

github.com/hwameistor/hwameistor is vulnerable to Privilege Escalation. The vulnerability is due to misconfiguration of the ClusterRole in Hwameistor, which allows overly broad permissions that can be abused by a malicious user...

2 TB of Sensitive “ServiceBridge” Records Exposed in Cloud Misconfiguration

A major database misconfiguration exposed millions of sensitive records belonging to ServiceBridge customers. Learn about the risks and…...

WordPress JobSearch Plugin <= 2.5.3 is vulnerable to PHP Object Injection

Software JobSearch Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A5: Security Misconfiguration Classification PHP Object Injection CVE CVE-2024-43931 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b092052f063 Credits Ananda Dhakal Patchstack...

WordPress Maintenance & Coming Soon Redirect Animation Plugin <= 2.1.3 is vulnerable to Bypass Vulnerability

Software Maintenance & Coming Soon Redirect Animation Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-43944 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 17bf0cc9007b Credits...

PT-2024-6951

Name of the Vulnerable Software and Affected Versions: Arc versions prior to 2024-08-26 Description: Arc browser, before version 2024-08-26, contains a remote code execution issue within JavaScript boosts. Normally, JavaScript boosts cannot be shared; however, misconfigured Firebase Access Contro...

Cross-Origin Resource Sharing (CORS) Bypass

github.com/usememos/memos is vulnerable to Cross-Origin Resource Sharing CORS Bypass. The vulnerability is due to a CORS misconfiguration where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true, which may allow an attacker to perform cross-origin requests,...

GHSA-P4FX-QF2H-JPMJ memos CORS Misconfiguration in server.go (GHSL-2024-034)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...

memos CORS Misconfiguration in server.go (GHSL-2024-034)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...

Casdoor CORS misconfiguration (GHSL-2024-035)

Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...

GHSA-MCHX-7J67-8MCF Casdoor CORS misconfiguration (GHSL-2024-035)

Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...

ALBeast: Misconfiguration Flaw Exposes 15,000 AWS Load Balancers to Risk

ALBeast is a critical vulnerability that allows attackers to bypass authentication and authorization in AWS ALB-based applications. Learn…...

CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...

UBUNTU-CVE-2024-43878

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...