CVE-2024-11334

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

CVE-2024-11334 My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

WordPress plugin My Contador lesr 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

An air fryer, a ring, and a vacuum get brought into a home. What they take out is your data (Lock and Code S05E24)

This week on the Lock and Code podcast… The month, a consumer rights group out of the UK posed a question to the public that they’d likely never considered: Were their air fryers spying on them? By analyzing the associated Android apps for three separate air fryer models from three different...

GHSA-QVF5-HVJX-WM27 Apache Tomcat Request and/or response mix-up

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through...

CVE-2024-11023

Firebase JavaScript SDK utilizes a "FIREBASEDEFAULTS" cookie to store configuration data, including an "authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "authTokenSyncURL" to point to thei...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from an out-of-bounds read vulnerability that stems from a lack of proper validation of user-supplied data, which can be exploited by an attacker to gain...

CVE-2024-50983

FlightPath 7.5 contains a Cross Site Scripting XSS vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user by including a malicious payload into the Last Name section in the Create/Edit Faculty/Staff User or...

python_book 安全漏洞

pythonbook is an online book lending website, book management system by Tim Green, an individual developer. A security vulnerability exists in pythonbook version V1.0, which stems from an access control error. An attacker can exploit the vulnerability to obtain sensitive information about users...

IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2024-45435)

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

These 8 Apps on Google Play Store Contain Android/FakeApp Trojan

Eight Android apps on the Google Play Store, downloaded by millions, contain the Android.FakeApp trojan, stealing user data…...

PT-2024-16823 · Transsion · Com.Transsion.Phoenix

Name of the Vulnerable Software and Affected Versions: com.transsion.phoenix affected versions not specified Description: There is an unauthorized access vulnerability in the mobile application com.transsion.phoenix, which can lead to the leakage of user information. The issue affects TECNO devic...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. The Linux Kernel suffers from an out-of-bounds read vulnerability that stems from a lack of proper validation of user-supplied data, which could be exploited by an attacker to...

GHSA-CW6G-QMJQ-6W2W Craft CMS Arbitrary System File Read

Summary By abusing the mail notification template it is possible to read arbitrary operating system files. Details The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, an...

Craft CMS Arbitrary System File Read

Summary By abusing the mail notification template it is possible to read arbitrary operating system files. Details The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, an...

Improper Privilege Management

Zope and AccessControl is vulnerable to Improper Privilege Management. The vulnerability is due to anonymous users being able to delete user data in AccessControl.userfolder.UserFolder, potentially preventing privileged access. Users unable to upgrade can mitigate by adding dataroles = to...

ChuanhuChatGPT Cross-Site Scripting Vulnerability (CNVD-2025-06193)

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT version 20240802 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escapin...

Criminals Exploiting FBI Emergency Data Requests

I've been writing about the problem with lawful-access backdoors in encryption for decades now: that as soon as you create a mechanism for law enforcement to bypass encryption, the bad guys will use it too. Turns out the same thing is true for non-technical backdoors: The advisory said that the...

SOCIFI Guest wifi 安全漏洞

SOCIFI Guest wifi is a web portal of SOCIFI UK. A security vulnerability exists in SOCIFI Guest wifi. An attacker exploiting this vulnerability could add or modify any random user data by sending a specially crafted cross-site request forgery request...

Nomysoft Informatics Nomysem 安全漏洞

Nomysoft Informatics Nomysem is an application from Nomysoft Informatics, Inc. A security vulnerability exists in Nomysoft Informatics Nomysem versions prior to 13.10.2024 that stems from an improper privilege management vulnerability that allows collection of user-supplied data...