Ant Media Server 安全漏洞

Ant Media Server is a real-time streaming engine software from Ant Media open source. It provides adaptive ultra-low latency streaming by using WebRTC technology with a latency of about 0.5 seconds. A security vulnerability exists in Ant Media Server version v2.8.2, which stems from insufficient...

IrfanView SVG File Parsing Heap Buffer Overflow Remote Code Execution Vulnerability

IrfanView is an image viewer. It supports image browsing, image editing, image format conversion and so on. A heap buffer overflow remote code execution vulnerability exists in IrfanView SVG file parsing, which is caused by failing to properly validate the length of user-supplied data before...

IrfanView PSP File Parsing Out-of-Bounds Write Remote Code Execution Vulnerability (CNVD-2024-46826)

IrfanView is an image viewer. It supports image browsing, image editing, image format conversion and so on. IrfanView PSP file parsing suffers from an out-of-bounds write remote code execution vulnerability caused by a lack of proper validation of user-supplied data, which can be exploited by an...

IrfanView WBZ plugin WB1 file parsing out-of-bounds write remote code execution vulnerability

IrfanView is an image viewer. It supports image browsing, image editing, image format conversion and so on. IrfanView WBZ plugin WB1 file parsing suffers from an out-of-bounds write remote code execution vulnerability caused by a lack of proper validation of user-supplied data, which can be...

PT-2024-31892 · Unknown · Openvidreview

Name of the Vulnerable Software and Affected Versions: OpenVidReview version 1.0 Description: The issue is related to Cross Site Scripting XSS in review names. This means an attacker could potentially inject malicious scripts into review names, which could then be executed by the browser of anoth...

“Hilariously insecure”: Andrew Tate’s The Real World breached, 800,000 users affected

Andrew Tate's online education platform The Real World—formerly known as Hustlers University—has been hacked and user data has been stolen. Hacktivists flooded the primary chatroom with emojis as proof that they had breached the site. After this they shared approximately 794,000 usernames of,...

Allegra 代码问题漏洞

Allegra is a project management software for mid-sized organizations from Allegra, Inc. Allegra suffers from a code issue vulnerability that stems from a lack of proper validation of user-supplied data. An attacker can exploit the vulnerability to execute arbitrary code...

Luxion KeyShot 安全漏洞

Luxion KeyShot is a software for designing photos of 3D scenes from Luxion, USA. The software allows real-time 3D rendering workflows to display results immediately and reduce the time required to create photorealistic product photos. A security vulnerability exists in Luxion KeyShot that stems...

CVE-2024-11334

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

CVE-2024-11334 My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

WordPress plugin My Contador lesr 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

An air fryer, a ring, and a vacuum get brought into a home. What they take out is your data (Lock and Code S05E24)

This week on the Lock and Code podcast… The month, a consumer rights group out of the UK posed a question to the public that they’d likely never considered: Were their air fryers spying on them? By analyzing the associated Android apps for three separate air fryer models from three different...

GHSA-QVF5-HVJX-WM27 Apache Tomcat Request and/or response mix-up

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through...

CVE-2024-11023

Firebase JavaScript SDK utilizes a "FIREBASEDEFAULTS" cookie to store configuration data, including an "authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "authTokenSyncURL" to point to thei...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from an out-of-bounds read vulnerability that stems from a lack of proper validation of user-supplied data, which can be exploited by an attacker to gain...

CVE-2024-50983

FlightPath 7.5 contains a Cross Site Scripting XSS vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user by including a malicious payload into the Last Name section in the Create/Edit Faculty/Staff User or...

python_book 安全漏洞

pythonbook is an online book lending website, book management system by Tim Green, an individual developer. A security vulnerability exists in pythonbook version V1.0, which stems from an access control error. An attacker can exploit the vulnerability to obtain sensitive information about users...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2024-45435)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

These 8 Apps on Google Play Store Contain Android/FakeApp Trojan

Eight Android apps on the Google Play Store, downloaded by millions, contain the Android.FakeApp trojan, stealing user data…...

PT-2024-16823 · Transsion · Com.Transsion.Phoenix

Name of the Vulnerable Software and Affected Versions: com.transsion.phoenix affected versions not specified Description: There is an unauthorized access vulnerability in the mobile application com.transsion.phoenix, which can lead to the leakage of user information. The issue affects TECNO devic...