Devise-Two-Factor 安全漏洞

Devise-Two-Factor is a minimalist extension of Devise to the Devise-Two-Factor open source. It is used to provide support for two-factor authentication via TOTP schemes. A security vulnerability exists in Devise-Two-Factor versions 2.2.0 and earlier and 6.0.0 and earlier, which stems from an...

GitLab 16.5 < 17.1.7 / 17.2 < 17.2.5 / 17.3 < 17.3.2 (CVE-2024-4472)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

GitLab 16.4 < 17.1.7 / 17.2 < 17.2.5 / 17.3 < 17.3.2 (CVE-2024-8124)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which could cause Denial of...

GitLab 13.7 < 17.1.7 / 17.2 < 17.2.5 / 17.3 < 17.3.2 (CVE-2024-8641)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Tophat 安全漏洞

Tophat is an open source testing tool from Shopify. A security vulnerability exists in Tophat versions prior to 1.10.0 that stems from improper protection of the TOPHATAPPTOKEN token, which can be obtained by an unauthenticated attacker via a maliciously constructed Tophat URL to gain access to...

CVE-2024-42270 affecting package kernel for versions less than 6.6.47.1-1

CVE-2024-42270 affecting package kernel for versions less than 6.6.47.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-42850

An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements...

CVE-2024-36971 affecting package kernel for versions less than 6.6.35.1-4

CVE-2024-36971 affecting package kernel for versions less than 6.6.35.1-4. An upgraded version of the package is available that resolves this issue...

CVE-2024-42244 affecting package kernel for versions less than 6.6.43.1-7

CVE-2024-42244 affecting package kernel for versions less than 6.6.43.1-7. An upgraded version of the package is available that resolves this issue...

REXML: DoS parsing an XML with many `<`s in an attribute value

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this...

IBM Java 7.1 < 7.1.5.23 / 8.0 < 8.0.8.30

The version of IBM Java installed on the remote host is prior to 7.1 7.1.5.23 / 8.0 8.0.8.30. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2024 advisory. - The Object Request Broker ORB in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 a...

CVE-2024-42218

1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms...

Dell InsightIQ Encryption Issue Vulnerability

Dell InsightIQ is a performance monitoring and reporting tool from Dell USA. A vulnerability in encryption issues exists in versions of Dell InsightIQ prior to 5.0.1, which can be exploited by an unauthenticated, remote attacker to cause information disclosure...

Acronis Cyber Infrastructure default password remote code execution

Acronis Cyber Infrastructure ACI is an IT infrastructure solution that provides storage, compute, and network resources. Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and software-defined networks, running cloud-native...

CVE-2024-20967 affecting package mysql for versions less than 8.0.36-1

CVE-2024-20967 affecting package mysql for versions less than 8.0.36-1. An upgraded version of the package is available that resolves this issue...

Dell Alienware Command Center Access Control Error Vulnerability (CNVD-2024-37422)

Dell Alienware Command Center is a package manager from Dell USA. An Access Control Error vulnerability exists in Dell Alienware Command Center version 5.7.3.0 and prior versions, which stems from the inclusion of improper access control and can be exploited by a low-privileged attacker to cause ...

GHSA-5248-H45P-9PGW SQL Injection in the KubeClarity REST API

Summary A time/boolean SQL Injection is present in the following resource /api/applicationResources via the following parameter packageID Details As it can be seen here, while building the SQL Query the fmt.Sprintf function is used to build the query string without the input having first been...

CVE-2024-6385

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

CVE-2024-39830

Mattermost CVE-2024-39830 affects Mattermost server versions 9.8.x through 9.5.x (specific fixes: 9.8.0, 9.7.4, 9.6.2, 9.5.5 and earlier). The root cause is non-constant time comparison for remote cluster tokens during remote cluster token checks when shared channels are enabled, which can allow ...

CVE-2024-4934 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...