AZL-48273 CVE-2023-49582 affecting package apr for versions less than 1.7.5-1

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h Users are...

CVE-2024-42056

Retool self-hosted enterprise through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered by an authenticated attacker via the /api/resources endpoint. The earliest affected version is 3.18.1...

CVE-2024-28987

The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data. Recent assessments: sfewer-r7 at November 22, 2024 4:16pm UTC reported: SolarWinds Web Help Desk is described as an...

CVE-2024-6337

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-25633

CVE-2024-25633 affects eLabFTW, where versions 4.4.0 up to (and not including) 5.0.0 allow regular users to create new, validated accounts within their team. If anonymous access is enabled, unauthenticated users can create accounts in any team. The issue was fixed starting with version 5.0.0 (Feb...

CVE-2024-25633 In eLabFTW, if administrators can create users, users can too

eLabFTW is an open source electronic lab notebook for research labs. In an eLabFTW system, one can configure who is allowed to create new user accounts. A vulnerability has been found starting in version 4.4.0 and prior to version 5.0.0 that allows regular users to create new, validated accounts ...

CVE-2024-7624

The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the...

CVE-2024-25024

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430...

PT-2025-18317 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 1.8.1 through 14.10.21 XWiki versions 15.0-rc-1 through 15.10.11 XWiki versions 16.0.0-rc-1 through 16.4.2 XWiki versions 16.5.0-rc-1 through 16.6.x Description: The issue allows anyone to access the metadata of any attachment ...

CVE-2024-22114

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard...

CVE-2024-5668 Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 2.7.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

RHEL 8 : Red Hat OpenStack Platform 16.1.9 (openstack-nova) (RHSA-2024:5113)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5113 advisory. OpenStack Compute codename Nova is open source software designed to provision and manage large networks of virtual machines,creating a redundant and...

CVE-2024-2937

CVE-2024-2937 affects Arm Mali GPU Kernel Drivers (Bifrost, Valhall) and Arm 5th Gen GPU Architecture Kernel Driver. DESCRIPTION: Use-After-Free in GPU memory handling allows a local, non-privileged user to access memory that has already been freed. Affected versions: Bifrost r41p0–r49p0; Valhall...

Improper Authorization

bostr is vulnerable to Improper Authorization.The vulnerability is due improper validation which lets any user access the api even when the authorizedkeys and noscraper is set to true. Attackers can exploit this by gaining access to the relay without proper authorization...

CVE-2024-3827 Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs

The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-39947

A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefully crafted data packet to the interface with vulnerabilities, causing the device to crash...

CVE-2024-23261

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.8. An attacker may be able to read information belonging to another user...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that reading the scheduling trace logs of /sys/kernel/debug/powerpc/dtl/cpu- when...

CVE-2024-24621 Softaculous Webuzo Authentication Bypass

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user...