Cross-Site Request Forgery (CSRF)

moodle/moodle is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to an incorrect CSRF token check in the bulk message sending feature of the Feedback module's non-respondents report, allowing an attacker to execute unauthorized actions...

CVE-2024-11918

The CVE-2024-11918 entry concerns the WordPress Image Alt Text plugin (versions

PT-2024-17345 · WordPress · Image Alt Text

Name of the Vulnerable Software and Affected Versions: Image Alt Text plugin for WordPress versions up to and including 2.0.0 Description: The issue allows authenticated attackers with subscriber-level access and above to update the alt text on arbitrary images due to a missing capability check o...

CVE-2024-11918: Missing Authorization

The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iataddalttxtaction and iatupdatealttxtaction AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with...

GHSA-QJJ3-GQX7-438W

creationtimestamp| type| source ---|---|--- 2024-11-27 18:35:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113556357993210876...

How Is API Abuse Different from Web Application Attacks by Bots?

API abuse and web application bot attacks are often confused. This is understandable, as both involve automated interactions and are usually executed by bots. Both attack vectors are prevalent; criminals are always eager to disrupt the foundations on which businesses base their operations to...

MAL-2024-11108 Malicious code in sync-ghes-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6392f0dcc6aab8ef4f6f380e3278d8b439e146ff540bd1c9e5b445a71ee577cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in sync-ghes-actions

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Google Chrome Navigation Privilege Escalation

The vulnerability of the Navigation section in the Google Chrome browser is related to insufficient compliance with policies. Exploiting this vulnerability allows a remote attacker to enhance their privileges through a series of actions on the user interface...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2024-2930)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2024-2924)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-51723

CVE-2024-51723 – BlackBerry AtHoc : A Stored XSS in the Management Console of AtHoc version 7.15 could allow an attacker to execute actions in the context of the victim’s session. Public details in PT-2024-34870 specify the vulnerable component as the Management Console and confirm the issue as a...

MAL-2024-10918 Malicious code in bigumner-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0ecfa30eaa3a6f615e3a69a8c0fa4b182d52f6632dd44848e5fff7acbdb5ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP12 : unbound (EulerOS-SA-2024-2924)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-buffer-overflow flaw was found in the cfgmarkports function within Unbound's configfile.c, which can lead to memory corruption.This issue...

Cindori Sensei Mac Cleaner has a security vulnerability

Cindori Sensei Mac Cleaner is a Mac cleaner, monitor, and optimizer application from Cindori, Inc. A security vulnerability exists in Cindori Sensei Mac Cleaner that stems from the presence of a local elevation of privilege issue, which allows an attacker to perform a variety of actions as root,...

CVE-2024-45513

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A stored Cross-Site Scripting XSS vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a...

CVE-2024-45512

An issue was discovered in webmail in Zimbra Collaboration ZCS through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious...

CVE-2024-45513

A stored Cross-Site Scripting (XSS) vulnerability exists in Zimbra Collaboration (ZCS) versions prior to 10.1.1 . The flaw is located in the /modern/contacts/print endpoint of Zimbra webmail. An attacker can exploit this by providing a crafted vCard (VCF) file , which, when processed and printed,...

CVE-2024-45513

An issue was discovered in Zimbra Collaboration ZCS through 10.1. A stored Cross-Site Scripting XSS vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a...

CVE-2024-45512

A stored Cross-Site Scripting (XSS) vulnerability exists in the Briefcase module of the Zimbra Collaboration Suite (ZCS) through version 10.1. The root cause is the lack of adequate measures to protect the web page structure. An attacker can exploit this by creating a folder containing a maliciou...