CVE-2024-49202

Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...

GHSA-653P-VG55-5652 Apache Tomcat Uncontrolled Resource Consumption vulnerability

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at...

CVE-2024-55976

CVE-2024-55976 is an SQL Injection in the WordPress plugin Critical Site Intel for WordPress (Critical Site Intel). Multiple connected sources identify the affected component as Critical Site Intel (plugin), with unauthenticated access to exploit, and a high overall severity (CVSS v3.1: 9.3; NETW...

CVE-2024-54438 WordPress Gaxx Keywords plugin <= 0.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in gaxx Gaxx Keywords gaxx-keywords allows Stored XSS.This issue affects Gaxx Keywords: from n/a through = 0.2...

BIT-NODE-MIN-2023-30588

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key inf...

UBUNTU-CVE-2024-8116

An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names...

CVE-2024-54313

CVE-2024-54313 is a path traversal/LFI vulnerability in the FULL – Cliente WordPress plugin. The vulnerability affects versions up to and including 3.1.25 and is reported as an authenticated issue (requires at least Contributor+ privileges). The root cause is local file inclusion via improper pat...

CVE-2024-54309 WordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through = 1.0.4...

CVE-2024-54286 WordPress Smaily for WP plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sendsmaily LLC Smaily for WP allows Stored XSS.This issue affects Smaily for WP: from n/a through 3.1.2...

CVE-2024-52066

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in RTI Connext Professional Routing Service allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0...

CVE-2024-52066 Potential stack corruption in Routing Service when using a malicious XML configuration document

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in RTI Connext Professional Routing Service allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.5.0, from 7.0.0 before 7.3.0.5, from 6.1.0 before 6.1.2.21, from 6.0.0...

UBUNTU-CVE-2024-8647

An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled...

CVE-2024-8179

Removed by vendor...

CVE-2024-9387 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint...

CVE-2024-10043 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

GitLab 15.2 < 17.4.6 / 17.5 < 17.5.4 / 17.6 < 17.6.2 (CVE-2024-8647)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in GitLab CVE-2024-8647 Note that Nessus has not tested for this issue but has instead relied only on the application's...

CVE-2024-53274

Habitica (open‑source habit builder) is affected by CVE-2024-53274. The vulnerability is a reflected XSS in the /home context via the register function in home.vue, caused by an insufficient sanitization function. An attacker can abuse a malicious redirectTo parameter to execute arbitrary JavaScr...

CVE-2024-50089 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50089 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50201 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50201 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-52847

CVE-2024-52847 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier and describes a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields that could cause malicious JavaScript to run in a victim’s browser when visiting the page. Connected advisories confirm multi...