7778 matches found
CVE-2024-22388
CVE-2024-22388 affects HID Global devices configured as encoders (e.g., iCLASS SE CP1000 Encoder, iCLASS SE Readers/Modules/Processors, OMNIKEY 5427CK/5127CK/5023/5027). Root cause: improper authorization in the encoder communication channel enables exposure of sensitive data when reader configur...
CVE-2024-22388 Insecure Default Initialization of Resource in HID Global
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...
CVE-2024-1259
A vulnerability was found in Juanpao JPShop up to 1.5.02. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/controllers/admin/app/AppController.php of the component API. The manipulation of the argument apppicurl leads to unrestricted upload. The...
mailcow resource management error vulnerability
mailcow is a mail server suite. A resource management error vulnerability exists in mailcow that stems from the application slowing down and becoming unresponsive in the administration page once the payload is successfully uploaded in the logo. No details of the vulnerability are provided at this...
PT-2024-20695 · Xenforo · Xenforo
Name of the Vulnerable Software and Affected Versions: XenForo versions prior to 2.2.14 Description: The issue allows Directory Traversal with write access by an authenticated user who has permissions to administer styles. This is possible when using a ZIP archive for Styles Import...
BIT-LIFERAY-2023-33946
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope...
Malicious Google Ads Target Chinese Users, Covertly Delivering RATs
Summary: Chinese-speaking users are being targeted in an ongoing malvertising campaign that leverages Google ads. The threat actor employs Google advertiser accounts to create deceptive ads that lure users into downloading Remote Administration Trojans RATs. The malicious ads are designed to mimi...
CVE-2023-6633
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks...
Cross site request forgery (csrf)
The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks...
CVE-2024-1014
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets...
Denial of service
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets...
CVE-2024-1014 Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets...
CVE-2024-1014
CVE-2024-1014: Uncontrolled resource consumption in SE-elektronic GmbH E-DDC3.3 (versions 03.07.03 and higher). An attacker could exhaust administration panel availability by sending multiple ICMP packets. Connected sources (NVD, enrichment feeds) note a possible PoC in exploitation data. CVE-202...
CVE-2024-1014 Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3
Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets...
Cisco Unity Connection Cross-Site Scripting Vulnerability (CNVD-2024-10470)
Cisco Unity Connection UC is a set of voice messaging platforms from the U.S. company Cisco Cisco. The platform can use voice commands to make calls or listen to messages hands-free. Cisco Unity Connection suffers from a cross-site scripting vulnerability that stems from the web-based...
[SECURITY] Fedora 39 Update: sudo-1.9.15-1.p5.fc39
Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...
Malicious Ads on Google Target Chinese Users with Fake Messaging Apps
Chinese-speaking users have been targeted by malicious Google ads for restricted messaging apps like Telegram as part of an ongoing malvertising campaign. "The threat actor is abusing Google advertiser accounts to create malicious ads and pointing them to pages where unsuspecting users will...
kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams, leading to a possible kernel crash and denial of service...
Cisco Unity Connection 安全漏洞
Cisco Unity Connection UC is a set of voice messaging platforms from the U.S. company Cisco Cisco. The platform can use voice commands to make calls or listen to messages hands-free. Cisco Unity Connection suffers from a cross-site scripting vulnerability that stems from the web-based...
