CVE-2024-1164 Brizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget error message and redirect URL in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied error messages...

GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...

JetBrains TeamCity Permission Issues Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a permissions issu...

WSO2 API Manager Documentation File Upload Remote Code Execution

A vulnerability in the 'Add API Documentation' feature allows malicious users with specific permissions /permission/admin/login and /permission/admin/manage/api/publish to upload arbitrary files to a user-controlled server location. This flaw could be exploited to execute remote code, enabling an...

CVE-2024-2089

CVE-2024-2089 is a Stored XSS in the WordPress plugin Remote Content Shortcode (versions

CVE-2024-36377

JetBrains TeamCity (versions prior to 2024.03.2) contains a permissions issue where certain API endpoints do not properly check user permissions. This could allow unauthorized actions by privileged users or actors if exposed to the API. Affected component: TeamCity API endpoints; root cause: insu...

CVE-2021-47564

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix double free issue on err path fix error path handling in presterabridgeportjoin that cases prestera driver to crash see below. Trace: Internal error: Oops: 96000044 1 SMP Modules linked in: presterapci...

fence-agents security and bug fix update

4.2.1-129 - bundled urllib3: fix CVE-2023-45803 Resolves: RHEL-18132 - bundled pycryptodome: fix CVE-2023-52323 Resolves: RHEL-20915 - bundled jinja2: fix CVE-2024-22195 Resolves: RHEL-22174 4.2.1-127 - fencescsi: fix registration handling if ISID conflicts Resolves: RHEL-5397 - fencezvmip:...

Silverstripe SiteTree Creation Permission Vulnerability

A vulnerability exists in the permission validation for SiteTree object creation. By default user permissions are not validated by the SiteTree::canCreate method, unless overridden by user code or via the configuration system. This vulnerability will allow users, or unauthenticated guests, to...

CVE-2024-2163 Ninja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets

The Ninja Beaver Add-ons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes such as urls. This makes it...

CVE-2024-4768

A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...

inDrive: Reflected XSS of media.indrive.com

Vulnerability description not provided...

CVE-2024-3974

The CVE-2024-3974 entry relates to the BuddyPress WordPress plugin and describes a Stored XSS vulnerability via the user_name parameter in versions up to 12.4.0. The issue requires authentication (Subscriber+ level) and can cause arbitrary scripts to run when a user visits an injected page. Publi...

lunary information disclosure vulnerability (CNVD-2025-12115)

lunary is a production toolkit for LLM. lunary suffers from an information disclosure vulnerability that stems from inadequate validation of user permissions when joining the organization. An attacker could use this vulnerability to read and modify all data within the organization...

CVE-2024-2085 HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-4226

It was identified that in certain versions of Octopus Server, that a user created with no permissions could view all users, user roles and permissions. This functionality was removed in versions of Octopus Server after the fixed versions listed...

CVE-2024-4226

CVE-2024-4226 affects Octopus Server; a user with no permissions could view all users, roles, and permissions in certain versions. The issue arises from behavior allowing visibility of identity/authorization data to unauthenticated-permissioned accounts. Connected documents corroborate this throu...

PT-2024-29811 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: A user created with no permissions could view all users, user roles, and permissions in certain versions of Octopus Server. This functionality was removed in versions of Octopus Serv...

CVE-2024-29183 OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login

OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of...

CVE-2023-6892

CVE-2023-6892 affects the EAN, UPC, ISBN Generator: Product Barcode Inventory for WooCommerce (EAN for WooCommerce) WordPress plugin. It is a Stored Cross-Site Scripting vulnerability exploitable via the alg_wc_ean_product_meta shortcode, in all versions up to and including 4.8.7, due to insuffic...