8479 matches found
Spina 跨站请求伪造漏洞
Spina is an easy-to-use CMS from SpinaCMS open source. A cross-site request forgery vulnerability exists in Spina version 2.18.0. An attacker can exploit this vulnerability to perform a cross-site request forgery attack...
WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme ListingPro versions = 2.9.4...
WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Yuchen Ji Patchstack Alliance in WordPress Plugin AI Engine versions = 2.4.7...
Medium: libreswan
Issue Overview: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not...
CVE-2024-37947
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2...
PT-2024-37168 · WordPress · Conditional Fields For Contact Form 7
Name of the Vulnerable Software and Affected Versions: Conditional Fields for Contact Form 7 plugin for WordPress versions up to, and including, 2.4.13 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpcf7cf admin init function...
OESA-2024-1847 mod_http2 security update
Modhttp2 is an official Apache httpd module, first released in 2.4.17. See Apache downloads to get a released version. modproxyhttp2 has been released in 2.4.23. Security Fixes: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a...
WordPress YITH Essential Kit for WooCommerce #1 plugin <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Plugin Install, Activation, and Deactivation vulnerability discovered by Lucio Sá in WordPress Plugin YITH Essential Kit for WooCommerce 1 versions = 2.34.0...
CVE-2024-40400
An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...
CVE-2024-41603
Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via the URI /admin/layout...
AZL-43414 CVE-2024-40725 affecting package httpd for versions less than 2.4.62-1
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local...
PT-2024-28790 · Open5Gs · Open5Gs
Name of the Vulnerable Software and Affected Versions: Open5GS version 2.6.4 Description: The issue is related to a Buffer Overflow. It affects the /lib/pfcp/context.c file. Recommendations: For Open5GS version 2.6.4, consider restricting access to the vulnerable file /lib/pfcp/context.c to...
Mattermost Mobile Apps Security Vulnerability
Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps version 2.16.0 and prior versions that stems from receiving push notifications without verifying that they are actually coming from the server they claim to be...
AZL-73323 CVE-2023-39327 affecting package openjpeg2 2.3.1-12
A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal...
WordPress plugin Events Calendar for Google Path Traversal Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...
WordPress plugin Seraphinite Accelerator Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability
Sensitive Data Exposure via Exported File vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Wallet System for WooCommerce versions = 2.5.13...
AZL-44982 CVE-2023-39328 affecting package openjpeg2 2.3.1-12
A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file...
CVE-2024-32056
A vulnerability has been identified in Simcenter Femap All versions V2406. The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted IGS part file. This could allow an attacker to execute code in the context of the current proce...
