Moderate: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Open Redirect vulnerability in FORM authentication CVE-2023-41080 tomcat: FileUpload: DoS due to accumulation of temporary files on Windows CVE-2023-42794 tomcat: improper...

PT-2024-10237

The affected software is IBM DevOps Velocity and IBM UrbanCode Velocity. The versions of IBM DevOps Velocity that are affected are 5.0.0, and the versions of IBM UrbanCode Velocity that are affected are 4.0.0 through 4.0.25. These versions allow web pages to be stored locally, which can then be...

PluXml Blog 5.8.9 Remote Code Execution Vulnerability

Exploit Title: PluXml Blog Version : 5.8.9 - Remote Code Execution Authenticated Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://pluxml.org/ Version : 5.8.9 Tested on: https://www.softaculous.com/apps/cms/PluXml 1 After login Click Static pages Edit Write in content your payloa...

PluXml Blog 5.8.9 Remote Code Execution

Exploit Title: PluXml Blog Version : 5.8.9 - Remote Code Execution Authenticated Date: 2024-1-7 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://pluxml.org/ Version : 5.8.9 Tested on: https://www.softaculous.com/apps/cms/PluXml 1 After login Click Static pages Edit Write in...

Exploit for Improper Input Validation in Amd Epyc_7203_Firmware

SEV Firmware Vulnerability This repo contains an exploit for...

Microsoft Edge (Chromium) < 120.0.2210.121 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 120.0.2210.121. It is, therefore, affected by multiple vulnerabilities as referenced in the January 5, 2024 advisory. - Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had...

CVE-2023-7027

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘device’ header in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This...

CVE-2023-50341

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

CVE-2023-50341

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

Improper access control

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

CVE-2023-50341 Improper Access Control affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by Improper Access Control Obsolete web pages vulnerability. Discovery of outdated and accessible web pages, reflects a "Missing Access Control" vulnerability, which could lead to inadvertent exposure of sensitive information and/or exposing a vulnerable endpoint...

HCL Technologies DRYiCE MyXalytics Security Breach

HCL Technologies DRYiCE MyXalytics is a unified reporting and dashboard product from HCL Technologies, USA. A security vulnerability exists in HCL Technologies DRYiCE MyXalytics due to a missing access control vulnerability in outdated and accessible web pages...

PT-2024-1065 · Google +4 · Angle Library +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.199 Description: A heap buffer overflow in the ANGLE library of Google Chrome allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is related to the WebG...

GitLab < 13.12.9 (CVE-2021-22245)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to view CVE-2021-22245 Note that Nessus has not tested for...

CVE-2023-45893

An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

CVE-2023-45892

An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

CVE-2023-45893

An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

Information disclosure

An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

MAL-2024-8 Malicious code in @authentication-pages/vue-cli-prebuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3c92ef13745278b15d59dfa706f96df5f1c3bb0261c9471d3e56eaa1449059e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @authentication-pages/vue-cli-prebuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3c92ef13745278b15d59dfa706f96df5f1c3bb0261c9471d3e56eaa1449059e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...