gnome-shell: code execution in portal helper

A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary...

The vulnerability of the CORS mechanism in Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CORS mechanism in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to a data source confirmation error during the processing of the resource://pdf.js path. Exploiting this vulnerability can allow an attacker to bypass security restrictions and gai...

CVE-2024-51989

The CVE-2024-51989 entry describes a cross-site scripting (XSS) vulnerability in PasswordPusher, affecting versions v1.41.1 through v1.48.0. The root cause is an unsanitized parameter that enables injection of malicious JavaScript. Affected deployments include self-hosted PasswordPusher installat...

CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...

CVE-2024-32870

creationtimestamp| type| source ---|---|--- 2024-11-05 02:09:21+00:00| seen| https://t.me/cvedetector/9804 2025-04-23 17:49:35+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-32870.yaml 2025-04-25 21:02:12+00:00| seen|...

PT-2024-33413 · Infomaniak · Vod Infomaniak

Name of the Vulnerable Software and Affected Versions: VOD Infomaniak versions 1.5.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This problem affects VOD Infomaniak, allowin...

PT-2024-9164 · Nextcloud +2 · Nextcloud Server +2

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.12 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 30.0.2 Description: The issue is related to insufficient authentication procedure in Nextcloud Server, allowing an attacke...

CVE-2024-7049 Exposure of Token in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process...

CVE-2024-7049 Exposure of Token in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process...

ROS-20241009-02

A vulnerability exists in Firefox ESR and Firefox due to a type error when searching for a property name in the "with" block. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code Firefox browser vulnerability, Firefox ESR vulnerability is related to...

kernel: netfilter: bridge: confirm multicast packets before passing them up the stack

A security vulnerability was identified in the Linux kernel's netfilter subsystem, specifically affecting the handling of multicast and broadcast packets on network bridges. The issue arises from a race condition in the connection tracking conntrack module when processing cloned socket buffers sk...

Exploit for CVE-2024-38816

CVE-2024-38816 Proof of Concept PoC This is a proof of conc...

CVE-2024-46938

creationtimestamp| type| source ---|---|--- 2024-09-16 01:08:32+00:00| seen| https://t.me/cvedetector/5700 2024-11-22 11:01:06+00:00| seen| https://infosec.exchange/users/dragonjar/statuses/113526260681347063 2024-11-22 12:17:30+00:00| confirmed|...

CVE-2024-45591

creationtimestamp| type| source ---|---|--- 2024-09-10 19:15:43+00:00| seen| https://t.me/cvedetector/5263 2025-02-11 16:54:25+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-45591.yaml 2025-02-12 21:02:03+00:00| seen|...

CVE-2024-8383

The Mozilla Foundation's Security Advisory: Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating...

CVE-2024-8383

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader...

CVE-2024-8383

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader...

Mozilla Firefox ESR < 128.2

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-40 advisory. - Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs...

Mozilla Firefox < 130.0

The version of Firefox installed on the remote Windows host is prior to 130.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-39 advisory. - Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that...

Mozilla Firefox ESR < 115.15

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-41 advisory. - The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were...