1890 matches found
com.cloudcoreo.plugins:cloudcoreo-deploytime (>=0.1.0, <=0.2.3), com.github.kostyasha.yet-another-docker:yet-another-docker-plugin (>=0.1.0-rc16, <=0.2.0) +4 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (2.1.3)
org.jenkins-ci.plugins:credentials MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - com.cloudcoreo.plugins:cloudcoreo-deploytime =0.1.0, =0.1.0-rc16, =0.1-beta, =0.4 -...
org.jenkins-ci.plugins:appio (>=1.1, <=1.3), org.jenkins-ci.plugins:config-file-provider (>=2.6, <=2.6.2) +1 more potentially affected by CVE-2024-47805 via org.jenkins-ci.plugins:credentials (1.4)
org.jenkins-ci.plugins:credentials MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:credentials and may be impacted: - org.jenkins-ci.plugins:appio =1.1, =2.6, =1.4, =1.4.9 Source cves: CVE-2024-47805 Source...
PT-2024-7542 · Unknown · Workstation
Name of the Vulnerable Software and Affected Versions: WorkstationST affected versions not specified Description: The issue is related to a lack of authentication for a critical function in the OPC server. This could allow a remote attacker to read or overwrite files on the configuration server...
PT-2024-39361 · 123Solar · 123Solar
Name of the Vulnerable Software and Affected Versions: jeanmarc77 123solar version 1.8.4.5 Description: A critical issue exists in the software, affecting an unknown part of the file config/config invt1.php. The manipulation of the PASSOx argument leads to code injection. This issue can be...
PT-2024-9158 · Nextcloud +1 · Nextcloud Enterprise Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.10 and prior to 29.0.7 Nextcloud Enterprise Server versions prior to 27.1.11.8, prior to 28.0.10, and prior to 29.0.7 Description: The issue is related to the insecure storage of confidential informatio...
PT-2024-37533 · WordPress · Funnelforms Free
Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.7.3.2 Description: The issue is related to arbitrary file deletion due to the plugin not properly validating a file or its path prior to deletion. This is made possible vi...
OESA-2024-2021 c-ares security update
This is c-ares, an asynchronous resolver library. It is intended for applications which need to perform DNS queries without blocking, or need to perform multiple Security Fixes: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as...
DEBIAN-CVE-2024-43168
DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...
AZL-47776 CVE-2024-43168 affecting package unbound for versions less than 1.19.1-2
DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...
UBUNTU-CVE-2024-43168
DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet...
NLnet Unbound 安全漏洞
NLnet Unbound is an open source DNS server from the Dutch NLnet team. NLnet Unbound has a security vulnerability that originates from a heap buffer overflow vulnerability in the function cfgmarkports in the file util/configfile.c. The vulnerability is caused by a heap buffer overflow vulnerabilit...
PT-2024-37487 · Unknown · Gaizhenbiao/Chuanhuchatgpt
Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410 Description: A vulnerability in the JSON file handling allows any user to delete any JSON file on the server, including critical configuration files such as config.json and ds config chatbot.json...
PT-2024-38132 · Totolink · Totolink A3000Ru
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3000RU version 5.9c.5185 Description: A problem was found in the processing of the file /web cste/cgi-bin/product.ini, which leads to the use of a hard-coded password. The issue has been disclosed to the public and may be used. The...
PT-2024-5851
Name of the Vulnerable Software and Affected Versions Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description A critical vulnerability was found in the Web Interface component of Raisecom devices, specifically in the file list base config.php. The manipulation of the template...
CVE-2024-36111 KubePi's JWT token validation has a defect
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the ke...
The vulnerability of the web interface of IP-telephone devices, BAS-IP, allows a perpetrator to disclose protected information.
The vulnerability of the web interface of IP-telephone devices BAS-IP relates to the storage of user credentials in configuration files. Exploiting this vulnerability can allow an attacker to disclose sensitive information by sending a specially crafted HTTP request...
CVE-2024-6317
The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.0.6. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...
CVE-2024-5824
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
CVE-2024-5824 Path Traversal in parisneo/lollms
A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...
