PT-2024-7647 · Zendesk · Zendesk

Name of the Vulnerable Software and Affected Versions: Zendesk versions prior to 2024-07-02 Description: The issue is related to improper authorization in Zendesk, allowing remote attackers to read ticket history via e-mail spoofing. This is because Cc fields are extracted from incoming e-mail...

WordPress plugin PowerPress Podcasting 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Tainacan SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Download Plugins and Themes in ZIP from Dashboard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

Plane 安全漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in Plane versions prior to v0.23.0, which stems from the use of wildcards to support the retrieval of an image from any hostname, which could allow an attacker to induce server-side...

pac4j 代码问题漏洞

pac4j is a simple yet powerful Java security engine from pac4j open source. It is used to authenticate users, obtain their profiles and manage authorizations to protect Web applications and Web services. A code issue vulnerability exists in pac4j versions prior to 4.0.0 that stems from being...

Bitcoin Core 安全漏洞

Bitcoin Core is a Bitcoin open source client for verifying the validity of blockchain transactions. A security vulnerability exists in versions of Bitcoin Core prior to 25.0, which stems from a vulnerability that allows a remote attacker to cause a denial of service by including transactions that...

Authd 安全漏洞

Authd is a cloud-based authentication daemon for identity providers in the Ubuntu open source. A security vulnerability exists in Authd versions prior to 0.3.6 that stems from insufficient randomization of user IDs to prevent conflicts, allowing a local attacker with a registered username to spoo...

UBUNTU-CVE-2023-45872

An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1. When a QML image refers to an image whose content is not known yet, there is an assumption that it is an SVG document, leading to a denial of service application crash if it is not actually an SVG document...

Google Chrome Type Obfuscation Vulnerability (CNVD-2024-44540)

Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions prior to Google Chrome V8 129.0.6668.100, which can be exploited by an attacker to cause heap corruption via specially crafted HTML pages...

TRtek Distant Education Platform SQL注入漏洞

TRtek Distant Education Platform is an application from TRtek, Inc. A SQL injection vulnerability exists in TRtek Distant Education Platform versions prior to 3.2024.11, which stems from improper input validation and allows for SQL injection and parameter injection...

Fortra Robot Schedule Enterprise Agent 安全漏洞

Fortra Robot Schedule Enterprise Agent is a component of Fortra's Enterprise Task Scheduler software. A security vulnerability exists in Fortra Robot Schedule Enterprise Agent versions prior to 3.05 that stems from FTP username and password information being written to the agent log file when...

AZL-50144 CVE-2024-9026 affecting package php for versions less than 8.1.30-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

AZL-50164 CVE-2024-8927 affecting package php for versions less than 8.3.12-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...

CVE-2024-43697

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input...

PT-2024-8643 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.6 Description: The issue is related to an infinite loop in the system, which can be exploited by a remote unauthenticated attacker to cause a denial of service. This means that the attacker can make the...

PT-2024-26089 · Unknown · Librtppayload.So

Name of the Vulnerable Software and Affected Versions: librtppayload.so versions prior to SMR Oct-2024 Release 1 Description: The issue is an out-of-bounds write in parsing h.263 format, which allows remote attackers to execute arbitrary code with system privilege. User interaction is required fo...

HPESBGN04708 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF; Remote: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The solution supports mobile content management, marketing and sales campaign management, and multi-site management. A...

PT-2024-32584 · Yith · Yith Woocommerce Product Add-Ons

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Product Add-Ons versions prior to 4.13.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations...