PT-2024-21327 · Unknown · Custom Fields

Name of the Vulnerable Software and Affected Versions: Custom Fields component affected versions not specified Description: The issue is related to the Custom Fields component not correctly filtering inputs, which leads to a cross-site scripting XSS vector. This means an attacker could potentiall...

PT-2024-37569 · Wbw · The Product Table

Name of the Vulnerable Software and Affected Versions: The Product Table by WBW plugin for WordPress version 2.0.1 and earlier Description: The issue is related to Remote Code Execution due to missing authorization and lack of sanitization of appended data in the languages/customTitle.php file...

New Mallox Ransomware Variant Targets Linux Systems

New variant of Mallox ransomware targets Linux systems using custom encryption and a builder web panel. Cybersecurity researchers…...

WordPress Easy Custom Code (LESS/CSS/JS) – Live editing Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Easy Custom Code LESS/CSS/JS – Live editing Type Plugin Vulnerable versions = 1.0.8 Fixed in 1.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37536 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9a38a57946fb Credits Cronus...

ALPINE-CVE-2024-33871

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp and oprp devices can have an arbitrary name for a...

Artifex Ghostscript Security Vulnerability

Artifex Ghostscript is a free software package from Artifex, Inc. based on Adobe, PostScript, and the Portable Document Format page description language. A security vulnerability exists in Artifex Ghostscript versions prior to 10.03.1, which allows execution of arbitrary code via a custom driver...

CVE-2024-33871

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp and oprp devices can have an arbitrary name for a...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from the inability to prevent the specification of a RemoteId when creating a new user, allowing an attacker to specify both a RemoteId and a us...

CVE-2024-34586

Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy...

Exploit for Path Traversal in Solarwinds Serv-U

CVE-2024-28995 Automated Path Traversal & Local File Read...

Moderate: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9

Secondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Advanced custom fields, 2.7.7, SQL Injection

Version: Old 2.8.2 / New 2.8.3 Update details: Improved sanitization/escaping of custom field values in v2.8.3 Update URL: https://www.tassos.gr/releases/advanced-custom-fields/advanced-custom-fields-2-8-3?format=htmlChangelog...

CVE-2024-39840

Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects...

CVE-2024-39840

Factorio before 1.1.101 is affected. A crafted server map can trigger arbitrary code execution on clients by abusing certain Lua base module functions to execute bytecode and create fake objects. Affected component: Factorio server/client interaction via custom maps; root cause: Lua base module f...

PT-2024-28696 · Factorio · Factorio

Name of the Vulnerable Software and Affected Versions: Factorio versions prior to 1.1.101 Description: The issue allows a crafted server to execute arbitrary code on clients via a custom map. This is achieved by leveraging the ability of certain Lua base module functions to execute bytecode and...

CVE-2024-39840

Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain Lua base module functions to execute bytecode and generate fake objects...

War Crime Prosecutions Enter a New Digital Age

A custom platform developed by SITU Research aided the International Criminal Court’s prosecution in a war crimes trial for the first time. It could change how justice is enacted on an international scale...

WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...

WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability

Subscriber+ Broken Access Control vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...

WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability

Contributor+ Broken Access Control vulnerability discovered by Security audit in WordPress Plugin Advanced Custom Fields PRO versions 6.3.2...