CVE-2024-11079

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within...

PT-2024-16742

Name of the Vulnerable Software and Affected Versions Ansible-Core versions 2.x Description A flaw was found in Ansible-Core, allowing attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code executi...

Red Hat Ansible 输入验证错误漏洞

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to distribute, manage, and program computer systems. An input validation error vulnerability exists in Red Hat Ansible that stems from the use of the hostvars object to reference...

Huawei EulerOS: Security Advisory for openjpeg2 (EulerOS-SA-2024-2835)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Hub Settings component of the JetBrains software for project and task management, YouTrack, allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Hub Settings component in the JetBrains YouTrack project and task management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow attackers to perform cross-site scripting attacks...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of TeamCity exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by utilizing the...

CVE-2024-48950

Logpoint prior to 7.5.0 contains a vulnerability where an endpoint used by Distributed Logpoint Setup is exposed, allowing unauthenticated attackers to bypass CSRF protections and authentication. Affected product: Logpoint (versions before 7.5.0). Root cause: exposed endpoint enabling CSRF/auth b...

The vulnerability of the Markdown Parsing component of the JetBrains YouTrack software suite for managing projects and tasks allows attackers to perform cross-site scripting attacks.

The vulnerability of the Markdown Parsing component in the JetBrains YouTrack project management and task management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow attackers to perform cross-site scripting attacks...

The vulnerability of the App Manifest component of the JetBrains YouTrack software environment allows a hacker to perform cross-site scripting attacks.

The vulnerability of the App Manifest component in the JetBrains YouTrack project management and task management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows attackers to perform cross-site scripting attacks...

Access Control Bypass

sigs.k8s.io/aws-load-balancer-controller is vulnerable to Access control bypass. The vulnerability is due to the controller’s automatic disassociation of WebACLs from ALBs when specific annotations are missing, which unintentionally removes WebACL protections, even if they were configured by AWS...

Microsoft Delays Windows Copilot+ Recall Release Over Privacy Concerns

Microsoft is further delaying the release of its controversial Recall feature for Windows Copilot+ PCs, stating it's taking the time to improve the experience. The development was first reported by The Verge. The artificial intelligence-powered tool was initially slated for a preview release...

The vulnerability of the web conference component of the MiCollab collaboration platform allows a attacker to perform cross-site scripting attacks.

The vulnerability of the web conference component of the MiCollab collaboration platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks...

The vulnerability of the jQuery UI JavaScript library, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.

The vulnerability of the jQuery UI JavaScript library is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow attackers to execute cross-site scripting attacks...

The vulnerability in the web application for managing and administering the SAP Commerce Backoffice platform arises from the lack of protective measures for the website structure. This allows attackers who operate remotely to carry out cross-site scripting attacks.

The vulnerability in the web application for managing and administering the SAP Commerce Backoffice platform is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

“HM Surf” macOS Flaw Lets Attackers Access Camera and Mic – Patch Now!

Researchers at Microsoft discovered a new macOS vulnerability, "HM Surf" CVE-2024-44133, which bypasses TCC protections, allowing unauthorized access…...

TrickMo Banking Trojan Can Now Capture Android PINs and Unlock Patterns

New variants of an Android banking trojan called TrickMo have been found to harbor previously undocumented features to steal a device's unlock pattern or PIN. "This new addition enables the threat actor to operate on the device even while it is locked," Zimperium security researcher Aazim Yaswant...

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge browsers allows attackers to perform cross-site scripting attacks.

The vulnerability of the Omnibox address bars in Google Chrome and Microsoft Edge is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Passwork password manager, related to the lack of protective measures for website structures, allows attackers to execute DOM-Based XSS attacks.

The vulnerability of the password manager Passwork is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute a DOM-Based XSS attack remotely...

PHP-Nuke Top Module SQL Injection

Exploit Title: PHP-Nuke SQL injection Top Module + protection Bypass Google Dork: intext: Powered by PHP-Nuke Date: 2024-10-07 Exploit Author: Emiliano Febbi Vendor Homepage: https://phpnuke.org/ Software Link: https://sourceforge.net/projects/phpnuke/files/phpnuke/ Version: 6.x New concept of...

The vulnerability of the graphical interface of the software platform for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows attackers to carry out cross-site scripting attacks.

The vulnerability of the graphical interface of the software platform for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to the lack of protective measures taken for the website structure. Exploiting this...