108855 matches found
CentOS 8 : thunderbird (CESA-2024:0964)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0964 advisory. - When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read...
PT-2024-18849 · WordPress · Pagelayer
Name of the Vulnerable Software and Affected Versions: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress versions up to, and including, 1.8.3 Description: The issue is related to Stored Cross-Site Scripting via custom attributes due to insufficient input sanitizatio...
CVE-2024-28173
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed...
Design/Logic Flaw
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed...
CVE-2024-28173
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed...
CVE-2024-28173
CVE-2024-28173 (JetBrains TeamCity) affects TeamCity versions 2023.11 through 2023.11.4, with information disclosure of custom build parameters of type “password” during data transmission. The PT-2024-2108 entry provides concrete details: affected versions are 2023.11–2023.11.4, and mitigation is...
Moderate: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.2.1 for RHEL 9
Secondary Scheduler Operator for Red Hat OpenShift 1.2.1 for RHEL 9 An update for secondary-scheduler-operator-bundle-container and secondary-scheduler-operator-container is now available for OSSO-1.2.1-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Moderate...
BIT-MATTERMOST-2022-1332
One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents...
BIT-MYBB-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
BIT-DISCOURSE-2023-36818
Discourse is an open source discussion platform. In affected versions a request to create or update custom sidebar section can cause a denial of service. This issue has been patched in commit 52b003d915. Users are advised to upgrade. There are no known workarounds for this vulnerability...
BIT-MATTERMOST-2024-1402
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to...
BIT-GITLAB-2024-1250 Privilege Chaining in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with managegroupaccesstokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation...
BIT-DRUPAL-2022-25278
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...
BIT-EJBCA-2021-40089
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...
BIT-APISIX-2021-43557 Path traversal in request_uri variable
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
CentOS: Security Advisory for firefox (CESA-2024:0976)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-27668
Flusity-CMS v2.33 is affected by: Cross Site Scripting XSS in 'Custom Blocks.'...
Cross site scripting
Flusity-CMS v2.33 is affected by: Cross Site Scripting XSS in 'Custom Blocks.'...
Schema Pro < 2.7.16 - Contributor+ Custom Field Access
Description The plugin does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode As a contributor, add/edit a post and embed aiosrsprocustomfield postid="ANYPOSTID" fieldkey="ANYMETAKEY" and specify/guess any po...
