CVE-2024-5674

The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the checkapikey function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete...

CVE-2024-5674 Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management

The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the checkapikey function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete...

AZL-42619 CVE-2024-5742 affecting package nano for versions less than 6.0-3

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privilege...

AZL-42649 CVE-2024-35255 affecting package telegraf for versions less than 1.31.0-9

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

AZL-42637 CVE-2024-35255 affecting package keda for versions less than 2.14.1-1

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

AZL-42789 CVE-2024-35255 affecting package azcopy for versions less than 10.25.1-1

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

AZL-42592 CVE-2024-35235 affecting package cups for versions less than 2.3.3op2-9

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the...

DEBIAN-CVE-2024-5696

By manipulating the text in an input tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12...

CVE-2024-5692

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as .url by including an invalid character in the extension. Note: This issue only affected Windows operating systems. Other operating systems are...

CVE-2024-5687

If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the Referer and Sec- headers, meaning there is the potential for incorrect...

UBUNTU-CVE-2024-5698

By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox 127...

UBUNTU-CVE-2024-5689

In addition to detecting when a user was taking a screenshot XXX, a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox 127...

UBUNTU-CVE-2024-5690

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12...

PT-2024-26512 · Unknown · Iceice666 Resourcepack Server

Name of the Vulnerable Software and Affected Versions: iceice666 ResourcePack Server versions prior to 1.0.8 Description: A Directory Traversal issue allows a remote attacker to disclose files on the server. The issue is related to the setPath in ResourcePackFileServer.kt. Recommendations: For...

Kiuwan SAST Cross-Site Scripting Vulnerability

Kiuwan is a powerful end-to-end application security platform. A cross-site scripting vulnerability exists in Kiuwan SAST versions prior to 2.8.2402.3, which stems from an unauthenticated Reflective Cross-Site Scripting XSS attack that can be executed on the login page...

AZL-43167 CVE-2024-37535 affecting package vte291 for versions less than 0.74.2-6

GNOME VTE before 0.76.3 allows an attacker to cause a denial of service memory consumption via a window resize escape sequence, a related issue to CVE-2000-0476...

AZL-42631 CVE-2024-37535 affecting package vte291 for versions less than 0.66.2-3

GNOME VTE before 0.76.3 allows an attacker to cause a denial of service memory consumption via a window resize escape sequence, a related issue to CVE-2000-0476...

WordPress ArForms Premium plugin < 6.6 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by mgthuramoemyint in WordPress Plugin ARForms versions 6.6...

AZL-50635 CVE-2024-5187 affecting package pytorch for versions less than 2.2.2-3

A vulnerability in the downloadmodelwithtestdata function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system,...

AZL-42490 CVE-2024-33655 affecting package unbound for versions less than 1.19.1-3

The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service resource consumption by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst which can be considered traffic amplification in some cases, aka the...