CVE-2024-10774: Missing Authentication for Critical Function

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

Code-Projects Simple CRUD Functionality: Code Injection Vulnerabilities

Code-Projects Simple CRUD Functionality is a Code-Projects open source web application. Code-Projects Simple CRUD Functionality version 1.0 suffers from a code injection vulnerability that stems from the vulnerability to cross-site scripting attacks via the newtitle/newdescr parameter...

MyBB <= 1.8.38 XSS Vulnerability

MyBB is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

PT-2024-22291 · Image Access Gmbh · Scan2Net

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The web application is not protected against cross-site request forgery attacks, allowing an attacker to trick users into performing actions on the...

PT-2024-35864

Name of the Vulnerable Software and Affected Versions Out Of Stock Badge versions 1.3.1 and earlier Description The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross-Site Request Forgery. This means an attacker can trick a user into performing unintended action...

CVE-2024-8308

A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data...

CVE-2024-8308 Siempelkamp: SQL injection due to improper handling of HTTP request input data

A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data which allows to exfiltrate all data...

PT-2024-38930 · Siempelkamp · Umweltoffice

Name of the Vulnerable Software and Affected Versions: Web Application affected versions not specified Description: A low privileged remote attacker can insert a SQL injection in the web application due to improper handling of HTTP request input data, which allows the exfiltration of all data. Th...

CVE-2024-53264

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

CVE-2024-53264 Open Redirect Vulnerability in Loading Page in bunkerweb

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

CVE-2024-53264

Summary: CVE-2024-53264 is an open redirect vulnerability in bunkerweb’s loading endpoint. The endpoint accepts an unvalidated the "next" parameter, enabling authenticated users to be redirected to arbitrary external URLs (e.g., /loading?next=https://google.com). This could be leveraged for phish...

GHSA-W5RQ-G9R6-VRCG @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

Impact A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a...

CVE-2024-53843 Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server

@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...

@alexaegis/svelte-config (>=0.9.2, <=0.11.6), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=1.1.3) +7 more potentially affected by CVE-2024-53261 via @sveltejs/kit (>=2.0.0, <=2.8.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.0-52469075, =10.0.1, =0.0.1-alpha.26, =0.0.10, =1.0.2, =1.0.3 Source cves: CVE-2024-53261 Source advisory: OSV:GHSA-RJJV-87MX-6X3H...

CVE-2024-11265

The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated...

CVE-2024-45369

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource...

CVE-2024-45369 mySCADA myPRO Improper Authentication

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource...

CVE-2024-45369

CVE-2024-45369 concerns mySCADA myPRO Manager, where a web-application parameter allows unauthorized access due to a weak authentication mechanism. Multiple connected sources corroborate an improper authentication vulnerability affecting myPRO Manager used for visualization/control of industrial ...

Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor

The China-aligned advanced persistent threat APT actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia. That's according to findings from cybersecurity firm ESET based on multiple Linux samples...

2FAuth security vulnerability

2FAuth is a web application from Bubka Personal Developer for managing two-factor authentication 2FA accounts and generating their security codes. A security vulnerability exists in 2FAuth versions prior to v5.4.1 that stems from an authentication bypass issue that allows an attacker to easily...