7390 matches found
Unitronics PCOM Client
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Unitronics PCOM Client', 'Description' = %q Unitronics Vision PLCs allow unauthenticated PCOM commands to query PLC registers. , 'Author' = 'Luis...
CVE-2024-42412
Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser...
CVE-2024-2541
The Popup Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the Subscribers Import feature. This makes it possible for unauthenticated attackers to extract sensitive data after an administrator has imported subscribers via...
WordPress Popup Builder plugin <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File vulnerability
Sensitive Information Exposure via Imported Subscribers CSV File vulnerability discovered by Tim Coen in WordPress Plugin Popup Builder versions = 4.3.6...
WordPress plugin WordPress plugin 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...
squid: Out-of-bounds write error may lead to Denial of Service
A flaw was found in Squid. An out-of-bounds write can be triggered when an Edge Side Includes ESI variable is assigned to a value not in the standard ASCII range, for example, multi-byte characters. This flaw allows a trusted server to crash Squid while processing an ESI response content, resulti...
Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2024-2282)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GO-2023-1285 sememos/memos vulnerable to Improper Handling of Values in github.com/usememos/memos
sememos/memos vulnerable to Improper Handling of Values in github.com/usememos/memos...
CVE-2024-7592
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resourc...
The vulnerability of the QuerySet.values() and values_list() methods of the Django web application’s JSONField model allows a attacker to execute arbitrary code.
The vulnerability of the QuerySet.values and valueslist methods of the Django web application’s JSONField model is related to the lack of security measures for handling SQL queries. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted SQL query...
CVE-2024-42312 sysctl: always initialize i_uid/i_gid
In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize iuid/igid Always initialize iuid/igid inside the sysfs core so setownership can safely skip setting them. Commit 5ec27ec735ba "fs/proc/procsysctl.c: fix the default values of iuid/igid on /proc/sys...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the use of uninitialized values...
CVE-2024-42475 OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNG
In the OAuth library for nim prior to version 0.11, the state values generated by the generateState function do not have sufficient entropy. These can be successfully guessed by an attacker allowing them to perform a CSRF vs a user, associating the user's session with the attacker's protected...
DEBIAN-CVE-2024-25939
Mirrored regions with different values in 3rd Generation IntelR XeonR Scalable Processors may allow a privileged user to potentially enable denial of service via local access...
CVE-2024-25939
Mirrored regions with different values in 3rd Generation IntelR XeonR Scalable Processors may allow a privileged user to potentially enable denial of service via local access...
REXML: DoS parsing an XML with many `<`s in an attribute value
REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this...
mozilla: Out of bounds read in editor component
The Mozilla Foundation Security Advisory describes this flaw as: Editor code failed to check an attribute value. This could have led to an out-of-bounds read...
CVE-2024-42165 Arbitrary User Activation
Insufficiently random values for generating activation token in FIWARE Keyrock = 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link...
CVE-2024-42163 Password Manipulation
Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link...
CVE-2024-42163 Password Manipulation
Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link...