15036 matches found
libfluid 安全漏洞
libfluid is an Open Networking Foundation open source application. A programmatic denial of service vulnerability exists in the libfluid fluidmsg::ActionList::unpack10 example, which can be exploited by an attacker to cause a denial of service...
libfluid 安全漏洞
libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::ActionSet::unpack routine contains a null pointer dereference vulnerability caused by an unchecked return value...
CVE-2024-47047
An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Reference IDOR in some configurations. An unauthenticated attacker can use this to display user-submitted data of all forms...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to the improper validation of the mail parameter in the createAction process. An unauthenticated attacker can display user-submitted data of all forms persisted by the extension. Note This vulnerability can onl...
CVE-2024-44128
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An Automator Quick Action workflow may be able to bypass Gatekeeper...
PT-2024-31705
Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 24.9.0 Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a known rule ID, without...
TYPO3 安全漏洞
TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 version 12.4.0 and earlier, which stems from an inability to validate the mail parameter of createAction, resulting in insecure direct object...
Apple macOS 安全漏洞
Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS version 13.7, which stems from Automator Quick Action Workflow may be able to bypass Gatekeeper...
CVE-2024-44128
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An Automator Quick Action workflow may be able to bypass Gatekeeper...
CVE-2024-44128
CVE-2024-44128 concerns macOS security where an Automator Quick Action workflow may bypass Gatekeeper. The issue was addressed by adding an additional prompt for user consent and is fixed in macOS updates: Ventura 13.7, Sonoma 14.7, and Sequoia 15. The available connected documents indicate the v...
CVE-2024-44128
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An Automator Quick Action workflow may be able to bypass Gatekeeper...
23andMe to pay $30 million in settlement over 2023 data breach
Genetic testing company 23andMe will pay $30 million to settle a class action lawsuit over a 2023 data breach which ended in some customers having information like names, birth years, and ancestry information exposed. In October 2023, we reported on how information belonging to as many as seven...
PT-2024-30167 · Unknown · Kashipara Music Management System
Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: The issue is related to Incorrect Access Control. It can be found in the /music/ajax.php endpoint, specifically when the action parameter is set to save user. This allows for...
CVE-2024-8797 WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers...
CVE-2024-8714
The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to...
CVE-2024-7423
The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the networkoptionsaction function. This makes it possible for unauthenticated attackers to update arbitrary options that...
CVE-2024-8734 Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scripting
The Lucas String Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-8737 PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scripting
The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-8732
The CVE-2024-8732 entry concerns the WordPress plugin Roles & Capabilities (Leira Roles) with a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient escaping of add_query_arg in the URL. Affected versions are up to and including 1.1.9. The vulnerability enables unauthenticate...