CVE-2024-3029

The CVE-2024-3029 issue affects mintplex-labs/anything-llm. A malformed JSON payload to /system/enable-multi-user triggers an error caught by a catch block that deletes all users and disables multi_user_mode, potentially allowing an attacker to remove existing users and create a new admin without...

CVE-2024-3029 Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint. This triggers an error that is caught by a catch block, which in turn deletes all users and disables the 'multiusermode'. The...

CVE-2024-31279

Cross-Site Request Forgery CSRF vulnerability in Catch Plugins Generate Child Theme.This issue affects Generate Child Theme: from n/a through 2.0...

CVE-2024-31279 WordPress Generate Child Theme plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Catch Plugins Generate Child Theme.This issue affects Generate Child Theme: from n/a through 2.0...

CVE-2024-31279

CVE-2024-31279 is a CSRF vulnerability in WordPress Generate Child Theme (Generate Child Theme plugin). Public details reference an issue affecting versions from n/a up to 2.0. Root cause described as cross-site request forgery leading to unauthorized actions within a user account. Connected Red ...

CVE-2024-31279: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Catch Plugins Generate Child Theme.This issue affects Generate Child Theme: from n/a through 2.0...

PT-2024-10006

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a race condition in the Linux kernel's kunit framework, specifically in the kunit try catch run function. This condition occurs when a kthread finishes after the...

Microsoft Windows Defender Bypass - Detection Mitigation Bypass Vulnerability

Back in 2022, the researcher released a proof of concept to bypass the Backdoor:JS/Relvelshe.A detection in Windows Defender but it no longer works as it was mitigated. However, adding a simple javascript try catch error statement and eval'ing the hex string, it executes as of the time of this...

spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry

A flaw was found in Spring Boot. This targets specifically 'spring-boot-actuator-autoconfigure' package. This issue occurs when an application is deployed to Cloud Foundry, which could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are...

PT-2023-35550 · Git +1 · Php

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address, which occurs during the execution of certain functions, including cleanup liv...

Single Failure in claim() Reverts Entire Transaction

Lines of code Vulnerability details Impact When the claim function is called it calls internally initializeMarketsmsg.sender which then loops through the whole market and other functions involving the user passed as parameter, the problem is that if one single thing fails everything will fail and...

the getChainlinkPrice() function calling the latestRoundData without using the try/catch to avoid bad possible scenario

Lines of code Vulnerability details Impact Call to latestRoundData could potentially revert and make it impossible to query any prices. the getChainlinkPrice function should use try/catch to avoid the case of the getChainlinkPrice function revert and cause dos/block the system. Proof of Concept t...

CVE-2023-25961

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Catch Themes Darcie theme = 1.1.5 versions...

CVE-2023-25961

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Catch Themes Darcie theme = 1.1.5 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Catch Themes Darcie theme = 1.1.5 versions...

CVE-2023-25961

CVE-2023-25961 is an unauthenticated, reflected cross-site scripting (XSS) vulnerability in Catch Themes’ Darcie WordPress theme, affecting versions up to 1.1.5. The issue is triggered through user-supplied input reflected in the page, enabling an attacker to execute script in the victim’s browse...

CVE-2023-25961 WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Catch Themes Darcie theme = 1.1.5 versions...

CVE-2023-25961: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Catch Themes Darcie theme = 1.1.5 versions...

PT-2023-20388 · Catch Themes · Catch Themes Darcie

Name of the Vulnerable Software and Affected Versions: Catch Themes Darcie theme versions 1.1.5 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website,...

SAP NetWeaver and SAP NetWeaver ABAP Server security vulnerabilities

SAP NetWeaver and SAP NetWeaver ABAP Server are products of SAP, Germany.SAP NetWeaver is an integrated, service-oriented application platform that provides a development environment for SAP applications. SAP NetWeaver is an integrated, service-oriented application platform that provides a...