JupyterHub 跨站脚本漏洞

JupyterHub is a multi-user server for Jupyter. A security vulnerability exists in JupyterHub versions prior to 4.1.0, which stems from a vulnerability that allows an attacker to directly impact a user's session by tricking the user into visiting a malicious subdomain...

Opswat Metadefender Core 安全漏洞

OPSWAT MetaDefender Core OPSWAT MDCore is a multi-engine anti-malware software from OPSWAT, Inc. It prevents the upload of malicious files on web applications that bypass sandboxing and other detection-based security solutions. A security vulnerability exists in Opswat Metadefender Core versions...

DEBIAN-CVE-2024-2887

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

PT-2024-18267 · Oracle · Sqlplus

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0b4 beta, 2.2.0p24, 2.1.0p41 and 2.0.0 EOL Description: The invocation of the sqlplus command with sensitive information in the command line in the mk oracle Checkmk agent plugin allows the extraction of this...

UBUNTU-CVE-2024-29943

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox 124.0.1...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China, for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco versions prior to 10.8.4, which stems from vulnerability to user enumeration attacks...

CVE-2024-1658

The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

AZL-36893 CVE-2024-2496 affecting package libvirt for versions less than 7.10.0-8

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of...

PT-2024-2271 · Unitronics · Unilogic

Name of the Vulnerable Software and Affected Versions: Unitronics Unistream Unilogic versions prior to 1.35.227 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to execute arbitrary code. Thi...

CImg Security Vulnerabilities

CImg is a small open source C++ toolkit for image processing from GREYC Open Source. A security vulnerability exists in versions prior to Clmg 3.3.3. An attacker exploited this vulnerability to cause a heap-based buffer overflow via a specially crafted cimglibrary::CImg::loadanalyze file...

JetBrains TeamCity 2023.05.3 - Remote Code Execution Exploit

Exploit Title: JetBrains TeamCity 2023.05.3 - Remote Code Execution RCE - Shodan Dork: http.title:TeamCity , http.favicon.hash:-1944119648 - Exploit Author: ByteHunter - Vendor: JetBrains - Email: email protected - vendor: JetBrains - Version: versions before 2023.05.4 - Tested on: 2023.05.3 -...

PT-2024-17237 · WordPress · Ht Easy Ga4 – Google Analytics Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: HT Easy GA4 – Google Analytics WordPress Plugin versions prior to 1.1.6 Description: The issue allows unauthorized modification of data due to a missing capability check on the login function. This makes it possible for unauthenticated...

PT-2024-18643 · Wpforms +2 · Wpforms +2

Name of the Vulnerable Software and Affected Versions: The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress versions prior to 1.3.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplie...

phlex Cross-Site Scripting Vulnerability

phlex is a framework for building object-oriented views in Ruby. A cross-site scripting vulnerability exists in versions prior to phlex 1.9.1, which stems from code that is not properly case-sensitive, resulting in cross-site scripting...

Go SDK for CloudEvents Security Vulnerability

Go SDK for CloudEvents is an official CloudEvents SDK open sourced by CloudEvents. A security vulnerability exists in Go SDK for CloudEvents versions prior to 2.15.2, which stems from the presence of a credential leak...

AZL-35663 CVE-2024-24786 affecting package kubevirt for versions less than 1.2.0-10

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-23302

Couchbase Server before 7.2.4 has a private key leak in goxdcr.log...

jose2go Security Vulnerabilities

jose2go is a Golang implementation of the Javascript object signing and encryption specification for individual developers at DV. A security vulnerability exists in jose2go versions prior to 1.6.0, which originated from a vulnerability that allows an attacker to cause a denial of service via a...

PT-2024-15380 · Thales · Thales Safenet Sentinel Hasp Ldk

Name of the Vulnerable Software and Affected Versions: Thales SafeNet Sentinel HASP LDK versions prior to 9.16 Description: A flaw in the installer for Thales SafeNet Sentinel HASP LDK on Windows allows an attacker to escalate their privilege level via local access. Recommendations: For versions...