CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...

CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...

WordPress Tutor LMS plugin <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' vulnerability

Cross-Site Request Forgery via 'addonenabledisable' vulnerability discovered by Ram in WordPress Plugin Tutor LMS versions = 2.7.4...

PT-2024-6370 · Microsoft · Sharepoint Server

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.5.0 through 24.7.4.1 Description: An arbitrary code execution issue exists when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, a specially crafted...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that stems from the addPreferencesForType method in the AccountTypePreferenceLoader.java file contains a proxy confusion with a possible way to...

PT-2024-6371 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 through 24.7.4.1 Description: An arbitrary code execution issue exists when the Weaviate integration is installed on the server. If a specially crafted SELECT WHERE clause containing Python code is run against a...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android that stems from the getRegistration method in the RemoteProvisioningService.java file containing an improperly validated input, and there is a...

PT-2024-20682 · Gallagher · Controller 6000 +1

Name of the Vulnerable Software and Affected Versions: Controller 6000 and Controller 7000 versions 8.70 and prior Controller 6000 and Controller 7000 versions 8.80 through 8.80.1938 MR6 Controller 6000 and Controller 7000 versions 8.90 through 8.90.2155 MR5 Controller 6000 and Controller 7000...

Pgpool-II vulnerable to information disclosure

Overview Pgpool-II is a cluster management tool. Pgpool-II contains an information disclosure vulnerability CWE-213 in its query cache function. PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development...

PT-2024-27909 · Zyxel · Zyxel Gs1900-10Hp

Name of the Vulnerable Software and Affected Versions: Zyxel GS1900-10HP firmware version V2.80AAZI.0C0 Description: An insufficient entropy vulnerability exists due to the improper use of a randomness function with low entropy for web authentication tokens generation. This could allow a LAN-base...

PT-2024-31220 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.1 Description: The issue is an arbitrary file read vulnerability. It affects the admin safe.php component. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

PT-2024-6387 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions through V5.21AAZF.18C0 Zyxel NAS542 versions through V5.21ABAG.15C0 Description: A command injection vulnerability in the export-cgi program of Zyxel NAS326 and NAS542 firmware could allow an unauthenticated attacker to...

PT-2024-21856 · Samsung · Exynos 1330 +8

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor Exynos versions including Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 1480, Exynos W920, Exynos W930 Description: The issue is related to a lack of input validation check on a...

PT-2024-39100 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects the file /endpoint/update.php, where the manipulation of the first name, middle name, and last name arguments...

PT-2024-37909 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The issue is related to the WP MultiTasking WordPress plugin not validating and escaping some of its shortcode attributes before outputting them back in a page/post whe...

PT-2024-39104 · Itsourcecode · Itsourcecode Payroll Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Payroll Management System version 1.0 Description: A critical issue has been found in the processing of the file "/ajax.php?action=delete deductions". The manipulation of the id argument leads to SQL injection. The attack may be...

PT-2024-18158 · WordPress · Ninja Forms - File Uploads

Name of the Vulnerable Software and Affected Versions: Ninja Forms - File Uploads plugin for WordPress versions up to, and including, 3.3.16 Description: The issue is a Stored Cross-Site Scripting vulnerability via an uploaded file, such as an RTX file, due to insufficient input sanitization and...

PT-2024-39096 · Sourcecodester · Sourcecodester Online Food Menu

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Food Menu version 1.0 Description: A critical issue has been found in the processing of the file /endpoint/delete-menu.php. The manipulation of the argument menu leads to SQL injection. The attack may be initiated...

Default installation of `synthetic-monitoring-agent` exposes sensitive information

Impact Users running the Synthetic Monitoring agent in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed thru a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and...

PT-2024-40302 · Jupyterlab +1 · @Jupyterlab/Mathjax-Extension +3

Name of the Vulnerable Software and Affected Versions: JupyterLite versions prior to 0.4.1 Description: The issue depends on user interaction by opening a malicious notebook with Markdown cells or a Markdown file using the JupyterLab preview feature. A malicious user can access any data accessibl...