PT-2024-6142

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache versions 1.9 through 6.3.0.1 Description An incorrect privilege assignment in the LiteSpeed Cache plugin for WordPress allows unauthenticated remote attackers to escalate privileges and gain administrator access. The issue stem...

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default, without any configuration option. This behavior can expose private network resources to unauthorized external access, leading to significant security...

CVE-2024-6221

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-6221

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-6221 Improper Access Control in corydolphin/flask-cors

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-6221

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-6221 Improper Access Control in corydolphin/flask-cors

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-6221 Improper Access Control in corydolphin/flask-cors

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

Unveiling Top API Vulnerabilities and Emerging Trends: Introducing the Wallarm Q2 2024 API ThreatStats™ Report

As we move through 2024, the Wallarm Research Team continues to monitor the evolving API vulnerability and threat landscape. Our latest Q2 ThreatStats™ Report reveals critical trends and developments that are reshaping the security environment. Continuing from our Q1 findings, the surge in AI API...

The Hidden Security Gaps in Your SaaS Apps: Are You Doing Due Diligence?

SaaS applications have become indispensable for organizations aiming to enhance productivity and streamline operations. However, the convenience and efficiency these applications offer come with inherent security risks, often leaving hidden gaps that can be exploited. Conducting thorough due...

ArtiPACKED Flaw Exposed GitHub Actions to Token Leaks

Discover how GitHub Actions artifacts leak sensitive authentication tokens, exposing popular open-source projects to security risks. Learn about…...

Adobe Commerce Cross-Site Scripting Vulnerability (CNVD-2024-44532)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site scripting vulnerability exists in Adobe Commerce that can be exploited by an attacker to execute malicious JavaScript in a browser...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380, CompactLogix 5480 Vulnerability : Improper Input Validation 2. RISK EVALUATION...

Rockwell Automation AADvance Standalone OPC-DA Server

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : AADvance Standalone OPC-DA Server Vulnerabilities : Improper Input Validation, Use of Externally Controlled Format String 2. RISK EVALUATION Successful...

Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks

Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as...

MAL-2025-5131 Malicious code in s3ffs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bcbd170ded254c386778d86dbd56a4d2fc5e7dfdeb37bd17fa2198e85e5c93c7 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5114 Malicious code in fsspecc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 90f4ad6035c504be5b282397b9a981d39fe71dcb0165be3b5d0571ac6274b51c Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

MAL-2025-5143 Malicious code in whee11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 457eb762160a23e220ee51c7d26f0b143c534243c23027ae0ae39be72af55cdb Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

TOTOLINK A3300R Buffer Overflow Vulnerability

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in the TOTOLINK A3300R. The vulnerability stems from the function UploadCustomModule parameter in the file /cgi-bin/cstecgi.cgi that causes a buffer overflow. No details of the...

SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34376)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. A security vulnerability exists in the SyroTech SY-GPON-1110-WDONT that originates when passwords are transmitted in plain text. An attacker could exploit this vulnerability to obtain password information and use this information...