CVE-2024-34068

CVE-2024-34068 affects Pterodactyl Wings. An authenticated user with access to a game server could bypass access controls in the pull endpoint of Wings, potentially accessing resources on local networks. The issue is addressed in version 1.11.2 ; upgrade is advised. As a workaround, users can ena...

PT-2024-3314 · Tinyproxy +2 · Tinyproxy +2

Name of the Vulnerable Software and Affected Versions: Tinyproxy versions 1.10.0 through 1.11.1 Description: A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy. This vulnerability can be triggered by a specially crafted HTTP header, leading to memory...

PT-2024-24401 · WordPress · Wp Migration Plugin Db & Files – Wp Synchro

Name of the Vulnerable Software and Affected Versions: WP Migration Plugin DB & Files – WP Synchro versions 1.11.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WP Migration Plugin DB & Files – WP Synchro. This issue allows for malicious requests to be made on behal...

WordPress WP Synchro plugin <= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.11.2...

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

Apache Avro Code Issue Vulnerability

Apache Avro is a data serialization system of the United States Apache Apache Foundation. It provides data serialization and data exchange services for Apache Hadoop. A code issue vulnerability exists in Apache Avro Java SDK version 1.11.2 and prior versions, which stems from a reader that may...

WordPress Elementor Addon Elements Plugin < 1.11.2 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webtechstreet:elementoraddonelements"; ifdescription...

CVE-2023-37918

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HT...

CVE-2022-3162 affecting package cert-manager for versions less than 1.11.2-1

CVE-2022-3162 affecting package cert-manager for versions less than 1.11.2-1. An upgraded version of the package is available that resolves this issue...

SUSE CVE-2011-0702

The fehuniquefilename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh temporary file...

GHSA-C2PJ-RR68-PW94 Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Version 1.11.2 contains a patch for this issue...

GHSA-HMVW-66JM-H9FH SQL Injection found in Dataease

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Version 1.11.2 contains a fix...

PT-2022-22013 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase version 1.11.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the parameter dataSourceId. There is no information about the estimated number of potentially affected devices worldwide or real-world...

PT-2022-16801 · Hashicorp +2 · Ingress Gateway +4

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.8.0 through 1.9.14 HashiCorp Consul and Consul Enterprise version 1.10.7 HashiCorp Consul and Consul Enterprise version 1.11.2 Description: The issue allows a user with service:write permissio...

gitea < 1.11.2 RCE Vulnerability

Gitea is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

UBUNTU-CVE-2021-45327

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code...

Gitea 安全漏洞

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea, which stems from the failure of some of the product's user APIs to determine that a request originates from a trusted user. The vulnerability can be exploited to execute...

CVE-2021-24259

The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting XSS by lower-privileged users such as contributors, all via a similar method...

WordPress 插件跨站脚本漏洞

WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress Elementor Addon Elements Plugin versions prior to 1.11.2. An attacker can exploit this vulnerability to launch a cross-site scripting attack...

Apache Flink JobManager Traversal

This module exploits an unauthenticated directory traversal vulnerability in Apache Flink versions 1.11.0 use auxiliary/scanner/http/apache/flinkjobmanagertraversal msf undefinedflinkjobmanagertraversal show actions ...actions... msf undefinedflinkjobmanagertraversal set ACTION msf...