CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-6447

The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related...

CVE-2024-3603 OSM – OpenStreetMap <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osmmap' shortcode in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible...

CVE-2024-4667

CVE-2024-4667 affects the WordPress plugin “Blog, Posts and Category Filter for Elementor” (all versions ≤ 1.0.3). The vulnerability is a Stored XSS caused by insufficient input sanitization and output escaping on the widget’s posts_types attribute, enabling authenticated attackers with contribut...

CVE-2024-6580

The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public k...

CVE-2024-4482

CVE-2024-4482 : The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is affected by Stored Cross-Site Scripting via the Countdown widget. Root cause: insufficient input sanitization and output escaping on the user-supplied text_day...

CVE-2023-35022

IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254...

CVE-2024-35139

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415...

CVE-2023-30430

IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace logs. IBM X-Force ID: 252183...

UBUNTU-CVE-2024-3959

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user...

PT-2024-12251 · Ibm · Ibm Security Access Manager Docker

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1 Description: The issue allows a local user to obtain root access due to improper access controls. Recommendations: For IBM Security Access Manager Docker versions 10.0.0.0...

SpiceDB exclusions can result in no permission returned when permission expected

Background Use of an exclusion under an arrow that has multiple resources may resolve to NOPERMISSION when permission is expected. For example, given this schema: zed definition user definition folder relation member: user relation banned: user permission view = member - banned definition resourc...

CVE-2024-5970

The MaxGalleria plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's maxgallerythumb shortcode in all versions up to, and including, 6.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-38505

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site...

CVE-2024-38505

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site...

CVE-2024-38505

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site...

CVE-2024-38505

JetBrains YouTrack (versions prior to 2024.2.34646) is affected by CVE-2024-38505 due to insufficient protection in the Access Token Handler, allowing user access tokens to be sent to a third-party site. The issue could permit unauthorized access to protected information. Remediation: upgrade to ...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...

CORSAIR iCUE Security Vulnerabilities

CORSAIR iCUE is a PC monitoring and RGB lighting control software from CORSAIR. It allows you to control and customize compatible RGB lighting devices, fans, keyboards, mice, headphones, and more. A security vulnerability exists in CORSAIR iCUE version 5.9.105 that originates from allowing an...

CVE-2024-37040

CVE-2024-37040 is associated with Schneider Electric Sage RTU devices. The vulnerability stems from a buffer copy without checking input size in the web interface, described as a classic Buffer Overflow (CWE-120). A malformed HTTP request could cause a fault in the device. Connected sources corro...