MyFinances Security Vulnerabilities

MyFinances is an open source web application from TreyWW Open Source. Designed to enable individuals and teams to manage their finances effectively. A security vulnerability exists in versions of MyFinances prior to 0.4.6 that stems from a method to access other customer invoices while logged in ...

WordPress plugin Pearl security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

ITSS iMLog Cross-Site Scripting Vulnerability

ITSS iMLog is a centralized monitoring tool from ITSS Corporation. A cross-site scripting vulnerability exists in ITSS iMLog prior to v1.308, which stems from a cross-site scripting vulnerability in the User Maintenance section that allows an attacker to inject a crafted payload to execute...

ResourcePack Server Security Vulnerability

ResourcePack Server is a small server hosting server resource pack by Brian Duan, an individual developer in China. A security vulnerability exists in iceice666 ResourcePack Server versions prior to v1.0.8, which stems from a vulnerability that allows remote attackers to disclose files on the...

PYSEC-2024-52

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...

PT-2024-27665

Name of the Vulnerable Software and Affected Versions lepture Authlib versions prior to 1.3.1 Description The issue concerns algorithm confusion with asymmetric public keys in lepture Authlib. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric...

CVE-2024-4620

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form...

CVE-2024-1662

Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data. This issue affects PowerBank Application: before 2.02...

CVE-2024-1662

Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data.This issue affects PowerBank Application: before 2.02...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in versions prior to Google Chrome 125.0.6422.141, which can be exploited by remote attackers to cause heap corruption via specially crafted HTML pages...

SUSE CVE-2023-38417

Improper input validation for some IntelR PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentially enable denial of service via adjacent access...

CVE-2024-36378

In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens...

VulnCheck KEV: CVE-2024-34444

Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0...

PT-2024-40484 · Unknown · Simplesamlphp

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp versions prior to 1.17.3 Description: The issue arises from SimpleSAMLphp's trust in metadata when sending SAML messages to other entities. If a malicious party alters the metadata to include JavaScript code in endpoint URLs,...

MarvinTest Solutions HW.exe 安全漏洞

MarvinTest Solutions HW.exe is a driver file from MarvinTest Solutions, USA. A security vulnerability exists in MarvinTest Solutions HW.exe versions prior to 5.0.5.0 that originates from a denial of service by allowing arbitrary mapping of physical memory with read/write access...

AZL-47691 CVE-2023-52755 affecting package kernel for versions less than 5.15.140.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab out of bounds write in smbinheritdacl slab out-of-bounds write is caused by that offsets is bigger than pntsd allocation size. This patch add the check to validate 3 offsets using allocation size...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is an open source application from GitHub in the United States. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions...

SUSE CVE-2024-4765

Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. This issue only affects Firefox for Android. Other versions of...

Tor Arti 安全漏洞

Tor Arti is a project of the Tor team to generate embeddable, production-quality implementations of the Tor anonymization protocol in the Rust programming language. A security vulnerability exists in Tor Arti versions prior to 1.2.3, which stems from a message length error...

Stalwart Mail Server 安全漏洞

Stalwart Mail Server is an all-in-one mail server from Stalwart Labs. A security vulnerability exists in Stalwart Mail Server versions prior to 0.8.0 that originates from a vulnerability that allows an attacker to gain full root access to the system...