Emby security vulnerabilities

Emby Media Server is a personal media server software for organizing, managing and sharing multimedia content such as music, movies, TV shows and more. Emby Media Server suffers from a cross-site scripting vulnerability that can be exploited to elevate privileges via the notifications.html...

CVE-2024-1955

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...

CVE-2024-1955

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...

CVE-2024-1955

CVE-2024-1955 affects the WordPress plugin Hide Dashboard Notifications (up to v1.3). Root cause: missing capability check in the warning_notices_settings function, enabling authenticated attackers with contributor+ rights to modify the plugin’s settings. Impact: unauthorized modification of data...

CVE-2024-1955: Missing Authorization

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...

WordPress plugin Hide Dashboard Notifications security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress Hide Dashboard Notifications plugin <= 1.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Contributor+ Plugin Settings Modification vulnerability discovered by Francesco Carlucci in WordPress Plugin Hide Dashboard Notifications versions = 1.3...

PT-2024-18449

Name of the Vulnerable Software and Affected Versions Hide Dashboard Notifications plugin for WordPress versions up to, and including, 1.3 Description The issue is related to a missing capability check on the warning notices settings function, allowing authenticated attackers with contributor...

WordPress Hide Dashboard Notifications Plugin <= 1.3 is vulnerable to Broken Access Control

Software Hide Dashboard Notifications Type Plugin Vulnerable versions = 1.3 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1955 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 47605ad93239 Credits Francesco Carlucci...

CVE-2024-38570 gfs2: Fix potential glock use-after-free on unmount

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100d1b started exploiting this behavior t...

How are attackers trying to bypass MFA?

In the latest Cisco Talos Incident Response Quarterly Trends report, instances related to multi-factor authentication MFA were involved in nearly half of all security incidents that our team responded to in the first quarter of 2024. In 25% of engagements, the underlying cause was users accepting...

Enhanced SSO Feature does not work. Applications fail to launch on Windows 11 devices.

After setting up Enhanced SSO according to https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/domain-passthrough-for-single-sign-on , it doesn't work. When trying to launch an application, nothing happens. When using traditional SSO using the old SSONVR.exe mechanism, there is no issu...

Exploit for Code Injection in Ssssssss Spider-Flow

Badges !MIT Licensehttps://img.shields.io/badge/Licens...

Important: firefox

Issue Overview: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. CVE-2024-4367 If the browser.privatebrowsing.autostart preference is...

Mozilla: Potential permissions request bypass via clickjacking

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions...

Mozilla: Potential permissions request bypass via clickjacking

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions...

Exploit for CVE-2022-21500

Badges !MIT Licensehttps://img.shields.io/badge/Licens...

PT-2024-40167

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises from the failure to properly encode user input, making notifications shown in modal windows in the TYPO3 backend susceptible to cross-site scripting. A valid backend user...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding of notifications shown in modal windows within the TYPO3 backend, which allows an attacker with a valid backend user account to execute arbitrary JavaScript in a users browser...

PT-2024-40283 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue arises from the failure to properly encode user input, making notifications shown in modal windows in the backend susceptible to cross-site scripting. A valid backend user account i...