PT-2024-20775

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-mongo versions prior to 4.0.0 Description The issue arises when SSL is enabled for the Mongo Hook, and the default settings include allow insecure, which causes certificates not to be validated. This behavior is...

PT-2024-19875 · Microsoft · Windows Network Drive Connector

Name of the Vulnerable Software and Affected Versions: Windows Network Drive Connector affected versions not specified Description: An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny...

CVE-2023-7089 Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG

The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7089 Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVG

The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

CVE-2023-7089

CVE-2023-7089 – Easy SVG Allow (WordPress)

WordPress Allow SVG Plugin < 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Allow SVG Type Plugin Vulnerable versions 1.2.0 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6541 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1ff41df5c9e Credits Bob Matyas Required privilege...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

CVE-2023-51749

ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

Design/Logic Flaw

ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

Design/Logic Flaw

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

PT-2024-14284 · Unknown · Scalefusion

Name of the Vulnerable Software and Affected Versions: ScaleFusion version 10.5.2 Description: The issue arises because ScaleFusion does not properly limit users to the Edge application, allowing file downloads to occur. The vendor notes that the default Windows device profile configuration, whic...

CVE-2023-51749

ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

WordPress Easy SVG Allow Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Easy SVG Allow Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7089 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 25d22827f930 Credits Bob Matyas Required privilege...

Design/Logic Flaw

nbviewer-app aka Jupyter Notebook Viewer before 0.1.6 has the get-task-allow entitlement for release builds...

Jupyter Notebook Viewer Security Vulnerability

Jupyter Notebook Viewer is a macOS application for viewing Jupyter/IPython notebooks. A security vulnerability exists in Jupyter Notebook Viewer prior to version 0.1.6, which stems from a problem with the get-task-allow function and can be exploited by an attacker to load untrusted code...

CVE-2023-51277

CVE-2023-51277 affects nbviewer-app (Jupyter Notebook Viewer) prior to version 0.1.6, where the release build incorrectly included the get-task-allow entitlement. This misconfiguration can enable loading of untrusted code, with reported high impact on confidentiality, integrity, and availability....