NVIDIA vGPU Software Security Vulnerability

NVIDIA vGPU Software is a management software from NVIDIA, USA, used to provide GPU capabilities to virtual machines. The software supports multiple virtual machines to access the host's GPU, providing graphics performance and application compatibility for virtual machines. A security vulnerabili...

Dell Secure Connect Gateway Security Vulnerability

Dell Secure Connect Gateway is a secure connectivity gateway from Dell USA. A security vulnerability exists in Dell Secure Connect Gateway that originates from allowing a remote, unauthenticated attacker to perform malicious actions on applications in an authenticated user's environment...

CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...

CVE-2024-5203

CVE-2024-5203 is described in IBM’s bulletin as a cross-site request forgery in Keycloak used by IBM i Modernization Engine for Lifecycle Integration. It allows a remote authenticated attacker to exploit improper input validation to send a crafted request to /login-actions/authenticate, potential...

CVE-2024-0427

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions...

GHSA-2CWW-FGMG-4JQC Keycloak's admin API allows low privilege users to use administrative functions

Users with low privileges just plain users in the realm are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data...

Description of the security update for SharePoint Enterprise Server 2016: June 11, 2024 (KB5002604)

None None...

CVE-2024-5687

If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the Referer and Sec- headers, meaning there is the potential for incorrect...

Hitachi Energy FOX61x, FOXCST, and FOXMAN-UN Products

SUMMARY Hitachi Energy is aware of a vulnerability that affects the FOXMAN-UN/FOXCST versions listed below. If exploited an attacker could potentially intercept or falsify data exchanges between the client and the server. Please refer to the “Recommended Immediate Actions” for information about...

CVE-2024-35207

CVE-2024-35207 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) prior to V1.2. The web interface is vulnerable to Cross-Site Request Forgery (CSRF); an attacker could trick an authenticated user into performing actions on the device without consent. Impact is described as high confiden...

Siemens SINEC Traffic Analyzer 跨站请求伪造漏洞

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communication between controllers and IO devices. The software detects PROFINET communication problems and reports them to the user via Web-UI. A cross-site request forgery vulnerability exists in Siemens SINEC...

CVE-2024-33850

Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. They can see the conference roster list, and perform certain actions that should not be allowed before they are admitted to the meeting...

Improper Restriction Of Rendered UI Layers Or Frames (Clickjacking)

zenml is vulnerable to Improper Restriction of Rendered UI Layers or Frames Clickjacking. The vulnerability is due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers, allowing an attacker to embed the application UI within an iframe on a...

CVE-2024-4328

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328

The CVE-2024-4328 issue is a CSRF vulnerability in the parisneo/lollms-webui v9.6, caused by using a GET request in clear_personality_files_list that lacks CSRF protection. This allows an attacker to coerce authenticated users into performing actions (e.g., deleting files) without consent. Affect...

CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...

Comtrend router WLD71-T1 cross-site request forgery vulnerability

Comtrend router WLD71-T1 is a router from China Comtrend Telecom Comtrend. A cross-site request forgery vulnerability exists in Comtrend router WLD71-T1 version v2.0.201820, which stems from vulnerability to a cross-site request forgery attack that allows an attacker to force an end user to perfo...

The vulnerability of the corporate version of the GitHub Enterprise Server, related to incorrect authorization, allows a perpetrator to create new branches in public repositories and execute arbitrary GitHub Actions processes with the permission of GITHUB_TOKEN.

The vulnerability of the corporate version of the GitHub Enterprise Server is related to improper authentication. Exploiting this vulnerability allows a malicious actor to create new branches in public repositories and execute arbitrary GitHub Actions processes with the permission of GITHUBTOKEN...