3268 matches found
Apache CloudStack Security Bypass Vulnerability (CNVD-2024-20837)
Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from a security bypass vulnerability that...
PT-2024-14532 · Unisoc (Shanghai) Technologies Co. +2 · T760/T770/T820/S8000 +5
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves a possible missing permission check in Plaintext COUNTER CHECK messages accepted before AS security activation. This could lead to...
AI-as-a-Service Providers Vulnerable to PrivEsc and Cross-Tenant Attacks
New research has found that artificial intelligence AI-as-a-service providers such as Hugging Face are susceptible to two critical risks that could allow threat actors to escalate privileges, gain cross-tenant access to other customers' models, and even take over the continuous integration and...
The vulnerability of the Grafana monitoring and observation platform, related to incorrect authentication, allows attackers to block attempts to access the system.
The vulnerability of the Grafana monitoring and observation platform lies in the registration of another person’s email address as a user name. Exploiting this vulnerability could allow a malicious actor to block attempts to access the system remotely...
The vulnerability of the Grafana monitoring and observation platform lies in its parallel execution, which occurs when using a shared resource with incorrect synchronization. This allows attackers to escalate their privileges.
The vulnerability of the Grafana monitoring and observation platform relates to the registration of another person’s email address as a user name. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...
Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations
Wiz researchers discovered architecture risks that may compromise AI-as-a-Service providers and put customer data at risk. Wiz and Hugging Face worked together to mitigate the issue...
PT-2024-24121 · Yubico +1 · Yubico Ykman-Gui +2
Name of the Vulnerable Software and Affected Versions: Yubico ykman-gui aka YubiKey Manager GUI versions prior to 1.2.6 Description: A privilege escalation issue exists because browser windows can open as Administrator when Edge is not used on Windows systems. This could allow for unexpected...
Hacklog Down As PDF <= 2.3.6 - Reflected Cross-Site Scripting
Description The Hacklog Down As PDF plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
MAL-2024-1163 Malicious code in paysafe-gpf-as-communication-lib-fe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997f87146bcd457b4e2cb94ddbcfbb3730c96dd9a2b5843fcabcbb9456cf899d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1164 Malicious code in paysafe-gpf-as-http-proxy-middleware-body-replace (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69515fe4abb4869b5999b249c8de31a55fd23bda38e3bd9de3c58c5c245bc5b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
April 2, 2024, update for PowerPoint 2016 (KB5002568)
None None...
CVE-2024-31090
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 荒野无灯 Hacklog Down As PDF allows Reflected XSS.This issue affects Hacklog Down As PDF: from n/a through 2.3.6...
CVE-2024-31090 WordPress Hacklog Down As PDF plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 荒野无灯 Hacklog Down As PDF allows Reflected XSS.This issue affects Hacklog Down As PDF: from n/a through 2.3.6...
CVE-2024-31090 WordPress Hacklog Down As PDF plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 荒野无灯 Hacklog Down As PDF allows Reflected XSS.This issue affects Hacklog Down As PDF: from n/a through 2.3.6...
PT-2024-23758 · Unknown · Hacklog Down As Pdf
Name of the Vulnerable Software and Affected Versions: Hacklog Down As PDF versions 2.3.6 and earlier Description: The issue affects the Hacklog Down As PDF software, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For versions 2.3.6...
funboot 跨站脚本漏洞
Funboot is a Yii2 based Saas rapid development platform by individual developer peanut funson86. A cross-site scripting vulnerability exists in funboot v1.1, which stems from an easy cross-site scripting attack via the title field in create a message...
WordPress Hacklog Down As PDF Plugin <= 2.3.6 is vulnerable to Cross Site Scripting (XSS)
Software Hacklog Down As PDF Type Plugin Vulnerable versions = 2.3.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31090 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 688ae2dee281 Credits Dimas Maulana Required privile...
CVE-2024-23755
ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode...
From Observer to Asuka – The Reinvention of Stealer
Summary: A malware-as-a-service MaaS called AsukaStealer, advertised on a Russian-language cybercrime forum by the alias breakcore, has surfaced. Priced at $80 per month, AsukaStealer is written in C++ and features customizable configurations and a user-friendly interface designed for harvesting...
