CVE-2024-12131: Authorization Bypass Through User-Controlled Key

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-12132: Authorization Bypass Through User-Controlled Key

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-56512: Not Using Complete Mediation

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

MAL-2024-12031 Malicious code in react-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 876139b096ddb1bf239489a666a6248e65ba5512906c207b40104c7efe2f1616 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12026 Malicious code in pushservicejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8875b705a6e055665ad1912b3f5aeca6578af2778e4b541e7061ae20d6ecbd01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mockapie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c6ab6842511adb800a707783d5712c9ef0fab67ae37078975c9a8580aa6121f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11999: Use of Unmaintained Third Party Components

CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product...

CVE-2024-11710: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'visibleParent' and 'id' parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter an...

CVE-2024-11711: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient...

MAL-2024-11831 Malicious code in imran-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15461cfacc497cef71b31228912fc6fdb11bee1b51f4f93604e7efa6337b63c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Siebel Server 8.5.1.x <= 8.5.1.7 / 8.6.0 / 8.6.1 (April 2019 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2019 CPU advisory. - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM subcomponent: Information Manager Console Apache Xalan. Supported versions...

Oracle Siebel Server <= 23.7 (January 2024 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the January 2024 CPU advisory. - Vulnerability in the Siebel CRM product of Oracle Siebel CRM component: EAI Jettison. Supported versions that are affected are Prior to 23.8. Easily...

Oracle Siebel Server <= 22.10 (April 2023 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the April 2023 CPU advisory. - Vulnerability in the Siebel CRM product of Oracle Siebel CRM component: Siebel Core - Server Infrastructure OpenSSL. Supported versions that are affected...

CVE-2024-54126: Download of Code Without Integrity Check

This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicio...

Laravel 11.0 Cross Site Scripting

/! - VULNERABILITY: Cross Site Scripting Laravel version 11.0 - Authenticated Persistent XSS - GOOGLE DORK: inurl:.com/?q= - GOOGLE DORK: Site:.com/?q= - DATE: 2024-12-01 - SECURITY RESEARCHER: E1.Coders - VENDOR: LARAVEL https://laravel.com/ - SOFTWARE LINK:...

PT-2025-3141

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to the KVM: x86 component in the Linux kernel, specifically with the complete hypercall exit function. It affects guests with protected state, such as SEV-ES and SEV-SNP. T...

Malicious code in commitlint-plugin-marketing-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e40a92c14d0b0d561bab0beb5da5e3d3dfb66d329e8b0ff2100fb7a8a87468b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-4343

A Python command injection vulnerability exists in the SagemakerLLM class's complete method within ./privategpt/components/llm/custom/sagemaker.py of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the eval function to parse a...

CVE-2024-4343

The CVE-2024-4343 entry describes a Python command injection in the imartinez/privategpt project. Affected component: SagemakerLLM.complete() in ./private_gpt/components/llm/custom/sagemaker.py, with versions up to and including 0.3.0. Root cause: unsafe parsing of a remote SageMaker LLM endpoint...

CVE-2024-4343 Python Command Injection in imartinez/privategpt

A Python command injection vulnerability exists in the SagemakerLLM class's complete method within ./privategpt/components/llm/custom/sagemaker.py of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the eval function to parse a...