1413 matches found
WordPress RSS Redirect & Feedburner Alternative plugin <= 3.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin RSS Redirect & Feedburner Alternative versions = 3.9...
WordPress RSS Redirect & Feedburner Alternative Plugin <= 3.9 is vulnerable to Broken Access Control
Software RSS Redirect & Feedburner Alternative Type Plugin Vulnerable versions = 3.9 Fixed in 4.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2dc0e834ad73 Credits Dhabaleshwa...
[SECURITY] Fedora 40 Update: abseil-cpp-20240116.2-1.fc40
Abseil is an open-source collection of C++ library code designed to augment the C++ standard library. The Abseil library code is collected from Google's own C++ code base, has been extensively tested and used in production, and is the same code we depend on in our daily coding lives. In some case...
WordPress wpDiscuz plugin <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin wpDiscuz versions = 7.6.15...
Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE
Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...
GHSA-W7HM-HMXV-PVHF HPACK decoder panics on invalid input
Due to insufficient checking of input data, decoding certain data sequences can lead to Decoder::decode panicking rather than returning an error. Example code that triggers this vulnerability looks like this: rust use hpack::Decoder; pub fn main let input = &0x3f; let mut decoder = Decoder::new;...
The vulnerability of server software like HAProxy, related to bypassing authentication using an alternative path or channel, allows attackers to obtain confidential information.
The vulnerability of the server software HAProxy is related to the inclusion of as part of the URI component. Exploiting this vulnerability can allow a remote attacker to obtain confidential information...
[SECURITY] Fedora 40 Update: ghc-isocline-1.0.9-28.fc40
A Haskell wrapper around the Isocline C library alternative to GNU Readline. The Isocline library is included whole and there are no runtime dependencies...
U.S. Sanctions 3 Cryptocurrency Exchanges for Helping Russia Evade Sanctions
The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC sanctioned three cryptocurrency exchanges for offering services used to evade economic restrictions imposed on Russia following its invasion of Ukraine in early 2022. This includes Bitpapa IC FZC LLC, Crypto Explorer DMCC...
EulerOS Virtualization 2.11.0 : avahi (EulerOS-SA-2024-1438)
According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord. CVE-2023-38469 - A...
RUSTSEC-2024-0320 yaml-rust is unmaintained.
The maintainer seems unreachable. Many issues and pull requests have been submitted over the years without any response. Alternatives Consider switching to the actively maintained yaml-rust2 fork of the original project: - yaml-rust2 - yaml-rust2 @ crates.io...
CVE-2024-26634 net: fix removing a namespace with conflicting altnames
In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG when a net namespace is removed. kernel BUG at net/core/dev.c:11520! Physical interfaces moved outside of initnet get "refunded" to initnet when that...
The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to bypassing the authentication process through an alternative path or channel, allows a hacker to perform arbitrary actions.
The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions remotely...
[SECURITY] Fedora 40 Update: truth-1.0.1-11.fc40
Truth is a library provides alternative ways to express assertions in unit tests. It can be used as a replacement for JUnit's assertions or FEST or it can be used alongside where other approaches seem more suitable...
Design/Logic Flaw
A CWE-693 “Protection Mechanism Failure” vulnerability in the embedded Chromium browser concerning the handling of alternative URLs, other than “ http://localhost” http://localhost” allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded...
RUSTSEC-2024-0416 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead...
Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled...
CVE-2024-27905 Apache Aurora: padding oracle can allow construction an authentication cookie
UNSUPPORTED WHEN ASSIGNED Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially thi...
The vulnerability of the ConnectWise ScreenConnect remote access software lies in its ability to bypass the authentication process by using an alternative path or channel. This allows a perpetrator to execute arbitrary code.
The vulnerability of the ConnectWise ScreenConnect remote access software lies in the ability to bypass the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor operating remotely to execute arbitrary code...