Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in Oqtane.Controllers.UserController. Remediation Upgrade Oqtane.Framework to version 6.0.1 or higher. References - GitHub Commit - GitHub PR - Medium Blog Credit:...

CVE-2024-55471

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

BIT-RAILS-2024-26143 Rails Possible XSS Vulnerability in Action Controller

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "html", a :default key which contains untrusted user input, and th...

PT-2024-36526 · Unknown · Oqtane Framework

Name of the Vulnerable Software and Affected Versions: Oqtane Framework affected versions not specified Description: The issue is related to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController, allowing unauthorized users to access sensitive information of other users by...

CVE-2024-55471

The Oqtane Framework (an open-source CMS and application framework) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the Oqtane.Controllers.UserController component. The vulnerability exists because certain endpoints do not enforce sufficient authorization checks to validate th...

CVE-2024-12793: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as problematic, has been found in PbootCMS up to 5.2.3. Affected by this issue is some unknown functionality of the file apps/home/controller/IndexController.php. The manipulation of the argument tag leads to path traversal. The attack may be launched remotel...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms, spiffe-helper, newrelic-k8s-metadata-injection, sriov-network-device-plugin, atlantis, crossplane-provider-aws-kinesis, trillian, apko, prometheus-pushgateway, argo-workflows, fuse-overlayfs-snapshotter, k8sgpt-operator,...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: sops-fips, flux-kustomize-controller, sops, grafana-fips, grafana, flux-kustomize-controller-fips, chezmoi, age-fips, litestream, ksops, age...

USN-7166-2 linux-aws, linux-aws-5.15 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - ACPI...

USN-7166-1 linux, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - ACPI...

CISCO-SA-20180418-WLC

creationtimestamp| type| source ---|---|--- 2024-12-17 09:00:35+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113667342681977139...

CISCO-SA-20181017-WLC

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:54+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794973785444...

CISCO-SA-20190501-APIC

creationtimestamp| type| source ---|---|--- 2024-12-17 06:40:58+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666792863457134...

CVE-2024-54411

Cross-Site Request Forgery CSRF vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n/a through = 3.2.0...

CVE-2024-54411 WordPress WP Controller plugin <= 3.2.0 - CSRF to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in hosting.io, campaigns.io WP Controller allows Stored XSS.This issue affects WP Controller: from n/a through 3.2.0...

CVE-2024-54411

CVE-2024-54411 involves WP Controller (WordPress plugin) with a CSRF to Stored XSS vulnerability affecting WP Controller versions up to 3.2.0. Connected sources (Red Hat, Wordfence) corroborate the CSRF-to-Stored-XSS description and indicate the patch status as Unpatched; no public exploit detail...

WordPress plugin WP Controller 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-54411: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in hosting.io WP Controller wp-management-controller allows Stored XSS.This issue affects WP Controller: from n/a through = 3.2.0...

PT-2024-36623 · Syncfusion · Syncfusion Essential Studio

Name of the Vulnerable Software and Affected Versions: Syncfusion Essential Studio for ASP.NET MVC versions prior to 27.1.55 Description: The issue is related to a traversal problem in the File Manager component, which is connected to the request parameter. This could potentially allow unauthoriz...

OESA-2024-2537 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issu...