CVE-2024-11355

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-11355 Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress plugin Ultimate YouTube Video & Shorts Player With Vimeo 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

Gladinet CentreStack 安全漏洞

Gladinet CentreStack is a premier mobile access and secure sharing solution from Gladinet USA. Provides self-hosted cloud storage. A security vulnerability exists in Gladinet CentreStack version v13.12.9934.54690. An attacker exploiting this vulnerability could access sensitive data or execute...

PT-2024-27749 · Gladinet · Gladinet Centrestack

Name of the Vulnerable Software and Affected Versions: Gladinet CentreStack version 13.12.9934.54690 Description: The issue allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field in the login page. Recommendations: For Gladin...

PT-2024-34173 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.2.1.2930 build 20241025 QNAP QuTS hero versions prior to h5.2.1.2929 build 20241025 Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system...

PT-2024-34175 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.2.1.2930 build 20241025 QNAP QuTS hero versions prior to h5.2.1.2929 build 20241025 Description: A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system...

Security Bulletin: IBM Technical Support Appliance - possible access to stale data

Summary Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. Vulnerability Details CVEID:CVE-2023-31346 DESCRIPTION: AMD SEV-SNP Firmware could allow a local authenticated attacker to obtain sensitive information, caused by the failu...

CVE-2024-11334

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

OSCAT Basic Library

RISK EVALUATION Successful exploitation of this vulnerability allows an local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected service. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

CVE-2024-11334 My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export

The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportarregistros function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data...

CVE-2024-11334

The CVE-2024-11334 entry concerns the WordPress plugin My Contador lesr. A missing capability check in exportar_registros() allows unauthenticated attackers to export user data in all versions up to 2.0. The vulnerability is triggered by insufficient access control on the CSV export path, enablin...

Mozilla Thunderbird Information Disclosure Vulnerability (CNVD-2025-00867)

Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. An information disclosure vulnerability exists in Mozilla Thunderbird, which can be exploited by attackers to obtain sensitive information...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple has fixed several vulnerabilities in iOS and iPadOS. Two vulnerabilities in iOS and iPadOS 17.7.2 CVE-2024-44308 & CVE-2024-44309 can lead to execution of arbitrary code. Apple states that active misuse of these vulnerabilities is known. A malicious party can exploit the vulnerabilities in...

CVE-2024-10665

The CVE-2024-10665 entry concerns the Yaad Sarig Payment Gateway For WC WordPress plugin. The connected documents confirm a root cause: a missing capability check in the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions, allowing authenticated attackers with Subscriber-level...

The vulnerability of the software for providing secure remote access to data in the GlobalProtect App software from Palo Alto Networks allows a perpetrator to cause service interruptions.

The vulnerability of the software for providing secure remote access to data in the GlobalProtect App software from Palo Alto Networks relates to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

HkCms 代码问题漏洞

HkCms is a free open-source content management system of Guangzhou Hengqi Education Technology Co. Ltd. HkCms file upload vulnerability, the vulnerability stems from a file upload vulnerability in the getFileName method in /app/common/library/Upload.php. The vulnerability can be exploited by an...

Immigration Police Can Already Sidestep US Sanctuary City Laws Using Data-Sharing Fusion Centers

Built to combat terrorism, fusion centers give US Immigration and Customs Enforcement a way to gain access to data that’s meant to be protected under city laws limiting local police cooperation with ICE...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to gain read, modify, or delete access to data.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data by sendin...

The vulnerability of the mount.vmhgfs component in the VMware Open-vm-tools module set is related to incorrect definition of symbolic links before accessing the file. This allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the mount.vmhgfs component in the VMware Open-vm-tools module set is related to incorrect definition of symbolic references before accessing the file. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause...