Intel® Data Center GPU Max Series Advisory

Summary: A potential security vulnerability in the Intel® Data Center GPU Max Series 1100 and 1550 products may allow denial of service. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-47165 Description: Improper conditions...

Email Subscribers by Icegram Express < 5.7.20 - Missing Authorization in handle_ajax_request

Description The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on the handleajaxrequest function in all versions up to, and including, 5.7.19. This makes it possible f...

CVE-2023-43040 IBM Spectrum Fusion HCI improper access control

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807...

PT-2024-19944 · Hcl · Hcl Commerce

Name of the Vulnerable Software and Affected Versions: HCL Commerce versions 9.1.12 through 9.1.13 Description: The issue allows for denial of service, disclosure of user personal data, and performing of unauthorized administrative operations. Recommendations: For versions 9.1.12 and 9.1.13, at t...

PT-2024-6445

Name of the Vulnerable Software and Affected Versions corydolphin/flask-cors versions 4.0.1 corydolphin/flask-cors version 5.0.1 Description The software contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching path...

Server-Side Request Forgery

next is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper handling of the Host header within Server Actions. This allows an attacker to make unauthorized requests that appear to originate from the Next.js application server, allowing access to internal network...

GHSA-FR5H-RQP8-MJ6G Next.js Server-Side Request Forgery in Server Actions

Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...

Next.js Server-Side Request Forgery in Server Actions

Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...

cri-o: Arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...

CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...

CVE-2024-34351

Next.js SSRF in Server Actions (CVE-2024-34351) affects self-hosted deployments using Server Actions with redirects to a relative path starting with “/” when Host header can be manipulated. Affected: Next.js prior to 14.1.1 (fixed in 14.1.1). Public writeups and PoC references exist in connected ...

CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions

Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that...

Improper Access Control

gradio is vulnerable to Improper Access Control . The vulnerability is due to improper validation of the isserverfn attribute for functions. This allows attackers to execute functions that should be restricted, potentially leading to unauthorized actions or access to sensitive data...

CVE-2024-4600

Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to lack of proper sanitisation of the ‘setparam.cgi’ file...

CVE-2024-4600 Cross-Site Request Forgery vulnerability in Socomec Net Vision

Cross-Site Request Forgery vulnerability in Socomec Net Vision, version 7.20. This vulnerability could allow an attacker to trick registered users into performing critical actions, such as adding and updating accounts, due to lack of proper sanitisation of the ‘setparam.cgi’ file...

nuclei_poc

Nuclei POCs Nuclei POCs, updated daily Chinesehttps://git...

PT-2024-25501 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the /admin/readDeal.php component, specifically via the mudi parameter set to clearWebCache. This allows for unauthorized actions to be performed on...

Oracle Linux 9 : xorg-x11-server (ELSA-2024-2169)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2169 advisory. - Fix use after free related to CVE-2024-21886 - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886, CVE-2024-0408 and...

CVE-2024-32962

A flaw was found in xml-crypto, where the default configuration lacks authorization checks for signers, only checking the signature's validity. This flaw allows malicious actors to pass a manipulated XML payload to instances of xml-crypto. By re-signing an XML document with a malicious private ke...