CVE-2024-36611

CVE-2024-36611 concerns Symfony v7.07 FormLoginAuthenticator with empty username/password handling. The connected documents reiterate the affected component and potential issues (authentication handling/DoS), but the supplier notes this is a false report. No additional technical details or confir...

CVE-2024-36611

In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic...

CVE-2024-8237 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips...

CVE-2024-11236 vulnerabilities

Vulnerabilities for packages: php...

CBL Mariner 2.0 Security Update: postgresql (CVE-2024-10976)

The version of postgresql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10976 advisory. - Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change...

Unlocking Google Workspace Security: Are You Doing Enough to Protect Your Data?

Google Workspace has quickly become the productivity backbone for businesses worldwide, offering an all-in-one suite with email, cloud storage and collaboration tools. This single-platform approach makes it easy for teams to connect and work efficiently, no matter where they are, enabling seamles...

curl: curl --continue-at confusion

Summary: When curl command is used with --continue-at, the --no-clobber is unexpectedly ignored and curl will append the output to the target file, even if it already exists. If --continue-at is used with--remove-on-error it can lead to unexpected removal of the file on early errors. Note that th...

Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule

CVE-2024-8856 This tool scans WordPress websites for vulnerab...

CVE-2024-52304 vulnerabilities

Vulnerabilities for packages: checkov, airflow, request-1276, kserve, py3-cassandra-medusa, awx, py3-aiohttp, dask-gateway, py3.13-scanner-test-libraries-aiohttp...

Taming API Sprawl: Best Practices for API Discovery and Management

APIs are the backbone of interconnected applications, enabling organizations to innovate, integrate, and scale rapidly. However, as enterprises continue to expand their digital ecosystems, they often encounter a common and complex challenge: API sprawl. Unchecked, API sprawl can lead to increased...

Apache Tomcat 11.0.0-M1 < 11.0.0 / 11.0.0-M23 < 11.0.0 Multiple Vulnerabilities

Binary data 701493.pasl...

CVE-2021-3741

A stored cross-site scripting XSS vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom...

CVE-2021-3741

A stored cross-site scripting XSS vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom...

CVE-2021-3741 Stored Cross-site Scripting (XSS) in chatwoot/chatwoot

A stored cross-site scripting XSS vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom...

CVE-2021-3741

Chatwoot stored XSS vulnerability (CVE-2021-3741) affecting chatwoot/chatwoot versions prior to 2.6.0. The issue arises from uploading an SVG file containing a malicious XSS payload in Profile Settings; when the avatar is opened, the injected JavaScript executes. Impact is described as execution ...

CVE-2024-1682

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of...

GHSA-P2H2-3VG9-4P87 vulnerabilities

Vulnerabilities for packages: gh...

CVE-2024-10977 vulnerabilities

Vulnerabilities for packages: postgresql...

Apache APISIX Dashboard Default Credentials

The scanner successfully authenticated on the Apache APISIX web application by using predictable credentials on its login form. No source data...

GHSA-F3CW-HG6R-CHFV Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

Summary Missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. Post-authentication, ALLOWADMINCHANGES=true Details Note: This is a sequel to CVE-2023-40035 In src/helpers/FileHelper.phpL106-L137, the function absolutePath...