IBM Java 7.1 < 7.1.5.23 / 8.0 < 8.0.8.30

The version of IBM Java installed on the remote host is prior to 7.1 7.1.5.23 / 8.0 8.0.8.30. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2024 advisory. - The Object Request Broker ORB in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 a...

CVE-2024-42218

1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms...

Dell InsightIQ Encryption Issue Vulnerability

Dell InsightIQ is a performance monitoring and reporting tool from Dell USA. A vulnerability in encryption issues exists in versions of Dell InsightIQ prior to 5.0.1, which can be exploited by an unauthenticated, remote attacker to cause information disclosure...

CVE-2024-20967 affecting package mysql for versions less than 8.0.36-1

CVE-2024-20967 affecting package mysql for versions less than 8.0.36-1. An upgraded version of the package is available that resolves this issue...

Dell Alienware Command Center Access Control Error Vulnerability (CNVD-2024-37422)

Dell Alienware Command Center is a package manager from Dell USA. An Access Control Error vulnerability exists in Dell Alienware Command Center version 5.7.3.0 and prior versions, which stems from the inclusion of improper access control and can be exploited by a low-privileged attacker to cause ...

GHSA-5248-H45P-9PGW SQL Injection in the KubeClarity REST API

Summary A time/boolean SQL Injection is present in the following resource /api/applicationResources via the following parameter packageID Details As it can be seen here, while building the SQL Query the fmt.Sprintf function is used to build the query string without the input having first been...

CVE-2024-6385

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...

CVE-2024-39830

Mattermost CVE-2024-39830 affects Mattermost server versions 9.8.x through 9.5.x (specific fixes: 9.8.0, 9.7.4, 9.6.2, 9.5.5 and earlier). The root cause is non-constant time comparison for remote cluster tokens during remote cluster token checks when shared channels are enabled, which can allow ...

CVE-2024-4934 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS

The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-33875 affecting package hdf5 for versions less than 1.14.4.3-1

CVE-2024-33875 affecting package hdf5 for versions less than 1.14.4.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-6129 affecting package nodejs for versions less than 20.14.0-1

CVE-2023-6129 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue...

Kibana 8.6.3 < 8.14 (ESA-2024-15)

The version of Kibana installed on the remote host is between 8.6.3 and 8.13.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-15 advisory. - A flaw was discovered in Kibana, allowing view-only users of alerting to use the runsoon API making the alerting rule run...

WordPress plugin EmbedSocial security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

AZL-42691 CVE-2024-38428 affecting package wget for versions less than 1.21.2-3

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent...

CVE-2024-4201

A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HT...

CVE-2024-36902 affecting package kernel for versions less than 5.15.158.2-1

CVE-2024-36902 affecting package kernel for versions less than 5.15.158.2-1. A patched version of the package is available...

VulnCheck KEV: CVE-2024-4898

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the...

OpenSSL 0.9.7 < 0.9.7h Vulnerability

The version of OpenSSL installed on the remote host is prior to 0.9.7h. It is, therefore, affected by a vulnerability as referenced in the 0.9.7h advisory. - The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option,...

CVE-2024-22524

dnspod-sr 0dfbd37 is vulnerable to buffer overflow...

CVE-2024-23107

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands...