Mozilla Firefox ESR < 115.15

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-41 advisory. - The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were...

Mozilla Firefox ESR < 115.15

The version of Firefox ESR installed on the remote Windows host is prior to 115.15. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-41 advisory. - The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the...

Security Vulnerabilities fixed in Thunderbird 115.15 — Mozilla

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the with environment. Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried t...

CVE-2024-45232

An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Reference IDOR. An unauthenticated attacker can use this to display the user-submitted data of all forms persisted by the...

vTiger CRM 7.4.0 Cross Site Scripting

CVE-ID:CVE-2024-44778 ------------------------------------------ Suggested description:A reflected cross-site scripting XSS vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a...

PT-2024-32118 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the nfsd4 deleg getattr conflict function in the Linux kernel, which does not properly confirm the expected manager before dereferencing fl-c.flc owner. This ca...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 that stems from an inability to validate email parameters that confirm an operation, resulting in an insecure direct object reference...

PT-2024-31490 · Typo3 · Powermail

Name of the Vulnerable Software and Affected Versions: powermail extension versions prior to 7.5.0 powermail extension versions prior to 8.5.0 powermail extension versions prior to 10.9.0 powermail extension versions prior to 12.4.0 Description: An issue was discovered in the powermail extension...

SUSE CVE-2022-48909

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix connection leak There's a potential leak issue under following execution sequence : smcrelease smcconnectwork if sk-skstate == SMCINIT sendclcconfirim tcpabort; ... sk.skstate = SMCACTIVE smccloseactive...

PT-2024-95: Cross-Site Request Forgery (CSRF) and Reflected Cross-Site Scripting (XSS) in Netcat CMS (module netshop)

The vulnerability was identified in Netcat CMS module netshop, version 6.4 Extra. The vulnerability is related to cross-site request forgery. The discovered vulnerability allows an authorized attacker with the administrator role to execute arbitrary JavaScript code in the browser of the attacked...

PT-2024-83: Reflected Cross-Site Scripting (XSS) in Netcat CMS (netshop module)

The vulnerability was identified in Netcat netshop module, version 6.4 Extra. The discovered vulnerability allows an authorized attacker with the administrator role to execute arbitrary JavaScript code in the browser of the attacked user. Vulnerability status: Confirmed by vendor Date of...

CVE-2024-7832

The CVE-2024-7832 issue concerns D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04. The vulnerability is in the function cgi_get_fullscr...

CVE-2024-7828 D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflow

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to...

gnome-shell: code execution in portal helper

A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary...

CVE-2024-6892

creationtimestamp| type| source ---|---|--- 2024-08-08 03:01:08+00:00| seen| https://t.me/cvedetector/2739 2025-03-11 11:09:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6892.yaml 2025-03-13 21:02:11+00:00| seen|...

CVE-2024-7300

Bolt CMS 3.7.1 is affected by a Cross‑Site Scripting (XSS) vulnerability in the Showcase Creation Handler. The issue resides in an unknown function of the file /bolt/editcontent/showcases, where manipulation of the title/textarea argument enables remote execution of scripts. The vulnerability can...

SUSE-SU-2024:2618-1 Security update for gnome-shell

This update for gnome-shell fixes the following issues: - CVE-2024-36472: Fixed portal helper automatically launched without user confirmation bsc1225567...

CVE-2024-41670 PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard

In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disable...

CVE-2024-41670

CVE-2024-41670 – PayPal Official module (PrestaShop) affects PrestaShop 7+ releases before 6.4.2 and PrestaShop 1.6 releases before 3.18.1. A logical weakness in the payment capture flow, when webhooks are disabled, can allow a malicious customer to confirm an order even if PayPal declines the pa...

PT-2024-29497 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 6.4.2 PrestaShop 1.6 versions prior to 3.18.1 Description: A logical weakness in the "PayPal Official" module for PrestaShop can be exploited by a malicious customer to confirm an order even if the payment is...