CVE-2024-55545

Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55544

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below...

CVE-2024-9252

Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2024-9729

Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2024-9725

Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2024-11525

IrfanView DXF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...

WordPress plugin SimpleGMaps 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

Harbor 授权问题漏洞

Harbor is an open source registry from Harbor Open Source. Artifacts are protected through policies and role-based access control to ensure that images are scanned and are not vulnerable, and that images are signed as trusted. Harbor suffers from an authorization issue vulnerability that stems fr...

PT-2024-39789 · Trimble · Trimble Sketchup Viewer

Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this issue, where...

Dell SmartFabric OS10 命令注入漏洞

Dell SmartFabric OS10 is a Debian Linux-based network operating system from Dell Networking designed to run on its PowerSwitch platform. A command injection vulnerability exists in Dell SmartFabric OS10 that stems from the system not filtering and validating user input at command execution. An...

PT-2024-39134

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 2.6.7 Description: The issue is related to missing file type validation in the jobsearch wp handle upload function, allowing authenticated attackers with...

Gitsign 安全漏洞

Gitsign is a tool from the individual developers of Gitsign that enables key-free completion of signing Git commits. A security vulnerability exists in Gitsign that stems from the fact that there is no additional validation to ensure that the hash of an entry matches the payload being validated...

PT-2024-39629 · WordPress · Wpglobus Translate Options

Name of the Vulnerable Software and Affected Versions: WPGlobus Translate Options plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is due to missing or incorrect nonce validation on the on translate options page function, making it possible for unauthenticated...

CVE-2024-9598

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the...

CVE-2024-9943

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php...

Realtek SD card reader driver 安全漏洞

The Realtek SD card reader driver is a card reader driver from China-based Realtek Semiconductor Realtek. A security vulnerability exists in Realtek SD card reader driver version 10.0.26100.21374 and prior versions, which stems from a lack of input validation and allows an attacker to write to...

GHSA-584Q-6J8J-R5PM secp256k1-node allows private key extraction over ECDH

Summary In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve: https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.jsL37-L39 loadCompressedPublicKey is, however, missing that check:...

PT-2024-16047 · Amazon · Amazon.Applicationloadbalancer.Identity.Aspnetcore

Name of the Vulnerable Software and Affected Versions: Amazon.ApplicationLoadBalancer.Identity.AspNetCore affected versions not specified Description: The issue concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore repository, which contains middleware for use with the Application Load...

PT-2024-33278 · Unknown · Secp256K1-Node

Name of the Vulnerable Software and Affected Versions: secp256k1-node versions prior to 5.0.1 secp256k1-node versions prior to 4.0.4 secp256k1-node versions prior to 3.8.1 Description: The issue affects the elliptic-based version of secp256k1-node, where the loadCompressedPublicKey function is...

PT-2024-39737 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress versions up to, and including, 4.7.4 Description: The issue is a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation on the wp ulik...