16950 matches found
CVE-2024-3623
CVE-2024-3623 describes a flaw in using mirror-registry to install Quay where a default database secret key is stored in plain text within a configuration template. This can cause all Quay instances deployed via mirror-registry to share the same database secret key, enabling a malicious actor to ...
CVE-2024-3623 Mirror-registry: default database secret key stored in plain-text on initial configuration file
A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...
CVE-2024-3622 Mirror-registry: plain-text default csrf secret key
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a...
CVE-2024-3622 Mirror-registry: plain-text default csrf secret key
A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a...
CVE-2024-3622
CVE-2024-3622 affects Quay deployments using mirror-registry, where a default secret is stored in plain-text in a configuration template. This enables an attacker to craft session cookies and potentially gain access to the affected Quay instance. The vulnerability is rooted in the reuse of the sa...
CVE-2023-6484 Keycloak: log injection during webauthn authentication or registration
A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...
CVE-2024-4035
The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.7.7.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2024-3988
The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to...
CVE-2024-3988
The Sina Extension for Elementor (WordPress plugin) is vulnerable under CVE-2024-3988 to Stored Cross-Site Scripting via the Sina Fancy Text Widget in versions up to 3.5.2. Exploitation requires authenticated access at contributor level+, and scripts can execute when users load injected pages. Th...
CVE-2024-4161
In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...
CVE-2024-4161 Syslog traffic sent in clear-text
In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic received clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...
WordPress Sina Extension for Elementor plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Sina Fancy Text Widget vulnerability discovered by wesley wcraft in WordPress Plugin Sina Extension for Elementor versions = 3.5.2...
PT-2024-28818 · WordPress · The Photo Gallery – Gt3 Image Gallery & Gutenberg Block Gallery
Name of the Vulnerable Software and Affected Versions: The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress versions up to, and including, 2.7.7.21 Description: The issue is related to Stored Cross-Site Scripting via image alt text due to insufficient input...
PT-2024-5142 · Brocade · Brocade Sannav
Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.0 Description: The issue is related to the transmission of syslog traffic in clear text, which could allow an unauthenticated, remote attacker to capture sensitive information. This could potentially lead ...
Syslog traffic sent in clear-text (CVE-2024-4161)
In Brocade SANnav, before Brocade SANnav v2.3.0, syslog traffic was received in clear text. This could allow an unauthenticated, remote attacker to capture sensitive information...
golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
A vulnerability was found in the golang.org/x/text/language package. An attacker can craft an Accept-Language header which ParseAcceptLanguage will take significant time to parse. This issue leads to a denial of service, and can impact availability...
CVE-2024-2477
The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all versions up to, and including, 7.6.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Moderate: Red Hat Security Advisory: less security update
An update for less is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
WordPress wpDiscuz plugin <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin wpDiscuz versions = 7.6.15...
