WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability discovered by justakazh Patchstack Alliance in WordPress Plugin Salon booking system versions = 10.7...

SUSE CVE-2024-31510

An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the cryptosignsignature parameter in the /pqcrystals-dilithium-standardml-dsa-44-ipdavx2/sign.c component...

Uniform Server Zero 安全漏洞

Uniform Server Zero is a free and lightweight WAMP server solution for Windows from the Uniform Server team. A security vulnerability exists in Uniform Server Zero version 10.2.5, which stems from a cross-site scripting vulnerability in the /usextra/phpinfo.php page...

PT-2024-24543 · Maccms · Maccms

Name of the Vulnerable Software and Affected Versions: MacCMS version 10, specifically versions including 2024.1000.3000 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload, exploiting a Cross Site Scripting vulnerability. Recommendations: For MacCMS...

WordPress Subscribe2 plugin <= 10.42 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Subscribe2 versions = 10.42...

iboss Secure Web Gateway 跨站脚本漏洞

iboss Secure Web Gateway is a web security solution from iboss designed to help organizations protect their networks from cyber threats and malicious activity. A cross-site scripting vulnerability exists in iboss Secure Web Gateway version 10.1 and earlier, which stems from a cross-site scripting...

IBM Security Verify Directory 加密问题漏洞

IBM Security Verify Directory is part of an authentication and access management solution from International Business Machines IBM. IBM Security Verify Directory version 10.0.0 suffers from a cryptographic issue vulnerability that stems from the use of weak encryption algorithms, which could be...

Malicious code in profectus-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062a69a64c4e77b2e5cebc7f5d21c239c51139c4d420c9fbf2e616f23ec838a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-12713 · Ibm · Ibm Cics Tx Advanced

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Advanced version 10.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

IBM CICS TX Advanced 安全漏洞

IBM CICS TX Advanced is a transaction processing monitoring system from International Business Machines IBM for running large-scale, high-transaction-volume applications in enterprise environments. An information disclosure vulnerability exists in IBM CICS TX Advanced version 10.1, which stems fr...

PT-2024-15179 · Thales · Thales Safenet Authentication Client

Name of the Vulnerable Software and Affected Versions: Thales SafeNet Authentication Client versions prior to 10.8 R10 Description: A flaw in the software allows an attacker to execute code at a SYSTEM level via local access on Windows. Recommendations: For versions prior to 10.8 R10, update to...

CVE-2023-31004

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a remote attacker to gain access to the underlying system using man in the middle techniques. IBM X-Force ID: 254765...

SUPERAntiSpyware Pro X Security Vulnerability

SUPERAntispyware is a security program from SUPERAntiSpyware. A security vulnerability exists in SUPERAntispyware Pro X version v10.0.1260, which originates from a programmatic denial of service by triggering the 0x9C402140 IOCTL code in the saskutil64.sys driver...

SUSE-SU-2024:0208-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Updated to Tomcat 10.1.18 - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing bsc1217649 Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html...

PT-2024-5030 · Artifex +4 · Artifex Ghostscript +4

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.0 Description: The issue is related to a heap-based overflow when the PDFPassword parameter has a 000 byte in the middle, which can be exploited by a remote attacker to cause a denial of service...

PT-2024-1264 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.3 watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 Description: The issue is related to the handling of temporary files, which may allow an a...

Scalefusion kiosk security vulnerability

ScaleFusion is a mobile device management and unified endpoint management application from ScaleFusion. A security vulnerability exists in the Scalefusion kiosk version 10.5.2, which stems from the ability to use Alt-F4, resulting in the inability to properly restrict users from using the Edge...

PT-2023-31801 · Unknown · Sandbox Accounts For Events

Name of the Vulnerable Software and Affected Versions: Sandbox Accounts for Events versions prior to 1.10.0 Description: The issue allows authenticated users to potentially read data from the events table by sending request payloads to the "events API", collecting information on planned events,...

UBUNTU-CVE-2023-46727

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory...

CVE-2023-38316

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt...