CVE-2022-25768 Improper Access Control in UI upgrade process

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade proces...

CVE-2024-38249

creationtimestamp| type| source ---|---|--- 2024-09-10 17:25:32+00:00| seen| https://www.thezdi.com/blog/2024/9/10/the-september-2024-security-update-review 2024-09-26 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1293/ 2024-09-26 05:00:00+00:00| seen|...

CVE-2024-38227

creationtimestamp| type| source ---|---|--- 2024-09-10 17:25:32+00:00| seen| https://www.thezdi.com/blog/2024/9/10/the-september-2024-security-update-review 2024-10-17 16:14:17+00:00| published-proof-of-concept| https://t.me/bizonechannel/1491 2024-10-19 14:19:20+00:00| seen|...

CVE-2024-8200

The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'updateapikey'...

CVE-2024-38114

creationtimestamp| type| source ---|---|--- 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review...

CVE-2024-7532

creationtimestamp| type| source ---|---|--- 2024-08-07 00:13:47+00:00| seen| https://t.me/cvedetector/2642 2024-08-08 13:39:01+00:00| seen| https://t.me/HackingInsights/9019 2024-08-13 18:05:01+00:00| seen| https://www.thezdi.com/blog/2024/8/13/the-august-2024-security-update-review...

Dell Update和Dell Alienware Update 安全漏洞

Dell Update and Dell Alienware Update are both an update driver from Dell USA Inc. A security vulnerability exists in Dell Update versions prior to 5.4 and Dell Alienware Update versions prior to 5.4, which arises from the inclusion of an exposed dangerous method or feature vulnerability. An...

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

...

SUSE SLES15: freeradius-server / freeradius-server-devel / freeradius-server-doc / etc (SUSE-SU-2024:2359-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2359-1 advisory. - CVE-2024-3596: Fixed chosen-prefix collision attack against MD5 bsc1223414. Tenable has extracted the preceding description...

HashiCorp go-getter security vulnerability

HashiCorp go-getter is a library for Go golang from HashiCorp, USA, for downloading files or directories from various sources using URLs as the primary form of input. A security vulnerability exists in HashiCorp go-getter version 1.7.4 and earlier, which stems from the possibility of being forced...

PT-2024-22649 · Dell · Dell Scg

Name of the Vulnerable Software and Affected Versions: Dell SCG versions prior to 5.24.00.00 Description: The issue is related to an Improper Access Control vulnerability in the SCG exposed for an internal update REST API. This API is only accessible if enabled by an Admin user from the UI. A...

Lunary Improper Access Control Vulnerability

lunary is lunary open source a production toolkit for LLM . An improper access control vulnerability exists in lunary, which can be exploited by an attacker to update any organization user as the organization owner...

PT-2024-4653 · D Link · D-Link Dir-1950

Name of the Vulnerable Software and Affected Versions: D-Link DIR-1950 versions up to v1.11B03 Description: The issue is related to the failure to validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to perform a man-in-the-middle...

OPENSUSE-SU-2024:0146-1 Security update for gifsicle

This update for gifsicle fixes the following issues: Update to version 1.95: - CVE-2023-46009: Fixed floating point exception vulnerability via resizestream at src/xform.c boo1216403...

WordPress SP Project & Document Manager plugin <= 4.71 - Data Update and File Download via IDOR vulnerability

Data Update and File Download via IDOR vulnerability discovered by fewwords in WordPress Plugin SP Project & Document Manager versions = 4.71...

CVE-2023-47166

A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network request to trigger this vulnerability...

PT-2024-13420 · Milesight · Milesight Ur32L

Name of the Vulnerable Software and Affected Versions: Milesight UR32L version 32.3.0.7-r2 Description: A firmware update vulnerability exists in the luci2-io file-import functionality. A specially crafted network request can lead to arbitrary firmware update. An attacker can send a network reque...

RHEL 8 : redhat-ds:11 (RHSA-2022:2210)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:2210 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol LDAP serve...

RHEL 7 : rh-git218-git (RHSA-2018:3800)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3800 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-serve...

PT-2024-20338 · WordPress · Salon Booking System

Name of the Vulnerable Software and Affected Versions: The Salon booking system WordPress plugin versions 9.6.5 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...