CVE-2023-52629

In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flushwork before timershutdownsync in switchdrvremove. Although we use flushwork to stop the worker, it could be rescheduled in...

WordPress Layouts for Elementor Plugin < 1.8 is vulnerable to Arbitrary File Upload

Software Layouts for Elementor Type Plugin Vulnerable versions 1.8 Fixed in 1.8 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Upload CVE CVE-2024-30533 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID f5141cd380b2 Credits Abdi Pranata Required...

PT-2024-23416

Name of the Vulnerable Software and Affected Versions Metagauss ProfileGrid versions through 5.7.8 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

WordPress Kanban Boards for WordPress Plugin <= 2.5.21 is vulnerable to Cross Site Scripting (XSS)

Software Kanban Boards for WordPress Type Plugin Vulnerable versions = 2.5.21 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31103 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d58cc62b701e Credits Yudistira Arya Requir...

WordPress Filter Custom Fields & Taxonomies Light Plugin <= 1.05 is vulnerable to PHP Object Injection

Software Filter Custom Fields & Taxonomies Light Type Plugin Vulnerable versions = 1.05 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-31094 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 49ff4d1a6e1e Credits Mika Required...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.74 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.74 Fixed in 2.2.76 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30441 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4841a04f2615 Credits Rafie Muhammad...

WordPress Spiffy Calendar Plugin <= 4.9.7 is vulnerable to Cross Site Scripting (XSS)

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.7 Fixed in 4.9.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30427 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID e5917dca625b Credits Dimas Maulana Required privileg...

WordPress Import Export WordPress Users Plugin <= 2.5.2 is vulnerable to Path Traversal

Software Import Export WordPress Users Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.5.3 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2024-30492 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 3a1a1c60408e Credits Ananda Dhaka...

FusionPBX Session Fixation

Vulnerability Name - Application is Vulnerable to Session Fixation Vulnerable URL: www.fusionpbx.com Overview of the Vulnerability Session fixation is a security vulnerability that occurs when an attacker sets or fixes a user's session identifier, manipulating the authentication process. Typicall...

CVE-2024-3019

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be...

CVE-2024-1313

A vulnerability was found in Grafana. Due to an error in authorization logic, it is possible for an unprivileged user in a different organization other than the snapshot owner to perform unauthorized actions such as deleting it using a view key. Mitigation Mitigation for this issue is either not...

Exploit for Code Injection in Wwbn Avideo

AVideo CVE-2024-31819 🎥🔒💥 This Python script is an exploit fo...

PT-2024-23142 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: A critical issue affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be initiated remotely...

Hitachi Energy MACH SCM (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.9 ATTENTION : Exploitable remotely Vendor : Hitachi Energy Equipment : MACH SCM Vulnerabilities : Improper Control of Generation of Code, Improper Neutralization of Directives in Dynamically Evaluated Code 2. RISK EVALUATION Successful exploitation of...

Exploit for Improper Access Control in Adobe Coldfusion

CVE-2024-20767 CVE-2024-20767https://nvd.nist.gov/vuln...

CVE-2024-30156

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

Exploit for Stack-based Buffer Overflow in Tenda Ac10_Firmware

PHP EXIF Memory Corruption Exploit to RCE CVE-2019-9641 !i...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a loss of confidentiality (CVE-2024-22356)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a loss of confidentiality. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-22356 DESCRIPTION: IBM App Connect Enterprise and IBM Integration Bus for...

PT-2024-22630 · WordPress · Wp-Lister Lite For Amazon

Name of the Vulnerable Software and Affected Versions: WP-Lister Lite for Amazon versions 2.6.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables potential...

JVN#22376992: WebProxy vulnerable to OS command injection

WebProxy provided by LunarNight Laboratory according to the original report submitted by the reporter is software to build a proxy server. WebProxy contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed with the privilege of the running web server...