2771 matches found
CVE-2024-6385
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances...
CVE-2024-39830
Mattermost CVE-2024-39830 affects Mattermost server versions 9.8.x through 9.5.x (specific fixes: 9.8.0, 9.7.4, 9.6.2, 9.5.5 and earlier). The root cause is non-constant time comparison for remote cluster tokens during remote cluster token checks when shared channels are enabled, which can allow ...
CVE-2024-4934 Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS
The Quiz and Survey Master QSM WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-6129 affecting package nodejs for versions less than 20.14.0-1
CVE-2023-6129 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2024-33875 affecting package hdf5 for versions less than 1.14.4.3-1
CVE-2024-33875 affecting package hdf5 for versions less than 1.14.4.3-1. An upgraded version of the package is available that resolves this issue...
Kibana 8.6.3 < 8.14 (ESA-2024-15)
The version of Kibana installed on the remote host is between 8.6.3 and 8.13.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2024-15 advisory. - A flaw was discovered in Kibana, allowing view-only users of alerting to use the runsoon API making the alerting rule run...
WordPress plugin EmbedSocial security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
AZL-42691 CVE-2024-38428 affecting package wget for versions less than 1.21.2-3
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent...
CVE-2024-4201
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HT...
CVE-2024-36902 affecting package kernel for versions less than 5.15.158.2-1
CVE-2024-36902 affecting package kernel for versions less than 5.15.158.2-1. A patched version of the package is available...
VulnCheck KEV: CVE-2024-4898
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...
OpenSSL 0.9.7 < 0.9.7h Vulnerability
The version of OpenSSL installed on the remote host is prior to 0.9.7h. It is, therefore, affected by a vulnerability as referenced in the 0.9.7h advisory. - The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option,...
CVE-2024-22524
dnspod-sr 0dfbd37 is vulnerable to buffer overflow...
CVE-2024-23107
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands...
CVE-2024-35311
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control...
WordPress Gianism plugin < 5.2.1 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Felipe Restrepo Rodriguez, Mateo Gutierrez Gomez in WordPress Plugin Gianism versions 5.2.1...
CVE-2024-22641
TCPDF version 6.6.5 and before is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted SVG file...
PT-2024-6103
Name of the Vulnerable Software and Affected Versions Requests versions prior to 2.32.0 Description The issue is related to the incorrect implementation of control flow in the Python Requests library, which can allow an attacker to access confidential data. When making requests through a Requests...
CVE-2019-9512 affecting package python-tensorboard for versions less than 2.16.2-1
CVE-2019-9512 affecting package python-tensorboard for versions less than 2.16.2-1. An upgraded version of the package is available that resolves this issue...