CVE-2024-2346

CVE-2024-2346 affects the FileBird – WordPress Media Library Folders & File Manager plugin for WordPress. All versions up to and including 5.6.3 are vulnerable to Insecure Direct Object Reference via folder deletion due to missing validation on a user-controlled key. This allows authenticated att...

CVE-2024-34148: Improperly Controlled Modification of Object Prototype Attributes

Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'...

CVE-2024-4336

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...

CVE-2024-4336

CVE-2024-4336 affects Adive Framework 2.0.8. The vulnerability is a persistent XSS due to insufficient encoding of user-controlled inputs, exploitable via the /adive/admin/tables/add endpoint across multiple parameters. The available documents indicate an attacker could retrieve the session detai...

CVE-2024-4336 Múltiple vulnerabilities on Adive Framework

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...

CVE-2024-4337

CVE-2024-4337 affects Adive Framework 2.0.8. The root cause is insufficient encoding of user-controlled inputs, causing a persistent XSS vulnerability via the /adive/admin/nav/add endpoint across multiple parameters. This can enable an attacker to retrieve authenticated user session details. Publ...

CVE-2024-4337 Múltiple vulnerabilities on Adive Framework

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user...

RHEL 9 : grafana-pcp (RHSA-2024:2569)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2569 advisory. grafana-pcp is an open source Grafana plugin for PCP. Security Fixes: grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decryptin...

CVE-2024-33542

Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5...

CVE-2024-33542: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Fabio Rinaldi Crelly Slider.This issue affects Crelly Slider: from n/a through 1.4.5...

PHP 安全漏洞

PHP is a scripting language in which PHP is executed server-side. A security vulnerability exists in PHP that originates when using the procopen command with array syntax, due to insufficient escaping, which allows a user to supply parameters to execute arbitrary commands in the Windows shell if...

CVE-2024-25050

CVE-2024-25050 affects IBM i versions 7.2–7.5 and IBM Rational Development Studio for i versions 7.2–7.5. The root cause is an unqualified library call in the networking and compiler infrastructure, allowing a local user to execute user-controlled code with elevated (administrator) privileges. Im...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

OESA-2024-1502 less security update

Less is a pager. A pager is a program that displays text files. Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files. Security Fixes: less through 653 allows OS command execution via a...

CVE-2024-32808

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9...

CVE-2024-32823

Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4...

CVE-2024-32823

Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4...

CVE-2024-32772

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9...

CVE-2024-32772

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9...

CVE-2024-32823

CVE-2024-32823 is an Authorization Bypass Through User-Controlled Key in the FeedbackWP Rate my Post – WP Rating System plugin, affecting Rate my Post plugin up to version 3.4.4. Public records (e.g., Red Hat CVE entry) confirm the root cause as authorization bypass. CVSS v3.1 base score is 5.3 (...