19061 matches found
CVE-2024-45512
A stored Cross-Site Scripting (XSS) vulnerability exists in the Briefcase module of the Zimbra Collaboration Suite (ZCS) through version 10.1. The root cause is the lack of adequate measures to protect the web page structure. An attacker can exploit this by creating a folder containing a maliciou...
CVE-2024-45510
An issue was discovered in Zimbra Collaboration ZCS through 10.0. Zimbra Webmail Modern UI is vulnerable to a stored Cross-Site Scripting XSS attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the...
CVE-2024-45510
Zimbra Collaboration (ZCS) versions through 10.0 are vulnerable to a stored Cross-Site Scripting (XSS) attack in the Zimbra Webmail (Modern UI) component. The root cause is the improper sanitization of user input , specifically allowing an attacker to inject malicious code into fields of an email...
CVE-2024-45510
An issue was discovered in Zimbra Collaboration ZCS through 10.0. Zimbra Webmail Modern UI is vulnerable to a stored Cross-Site Scripting XSS attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the...
CVE-2024-52359
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls...
CVE-2024-52359
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls...
CVE-2024-52359 IBM Concert Software improper access controls
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls...
DEBIAN-CVE-2024-50296
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call function pcidisablesriov. The numVFs is check...
PT-2024-35230
Name of the Vulnerable Software and Affected Versions W3SPEEDSTER versions n/a through 7.25 Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...
PT-2024-30504
Name of the Vulnerable Software and Affected Versions Crowdsignal Dashboard – Polls, Surveys & more versions n/a through 3.1.2 Description A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed. Recommendations For versions n/a through 3.1.2,...
CVE-2024-52359: Incorrect User Management
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to improper access controls...
PT-2024-34775
Name of the Vulnerable Software and Affected Versions Eftakhairul Islam Sticky Social Bar versions 2.0 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricki...
PT-2024-35201 · Ibm · Ibm Concert
Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.0.2.1 Description: The issue allows an authenticated user to perform unauthorized actions that should be reserved for administrators due to improper access controls. Recommendations: For versions...
CVE-2024-52587
A flaw was found in Harden-Runner. Multiple command injection weaknesses via environment variables were identified that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of harden-runner as the...
Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
Summary Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of...
GHSA-G85V-WF27-67XC Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`
Summary Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under specific conditions. However, due to the current execution order of pre-steps in GitHub Actions and the placement of...
CVE-2024-52587 Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under...
CVE-2024-52587 Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of step-security/harden-runner prior to v2.10.2 contain multiple command injection weaknesses via environment variables that could potentially be exploited under...
CVE-2024-52587
StepSecurity's Harden-Runner (versions prior to v2.10.2 ) contains multiple command injection weaknesses in setup.ts and arc-runner.ts. The root cause is the use of execSync with interpolated environment variables, such as process.env.USER, $USER, and RUNNER_TEMP, which can allow an attacker to i...