145 matches found
CVE-2024-56521
creationtimestamp| type| source ---|---|--- 2024-12-27 04:32:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113722915496819427 2024-12-27 04:37:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113722933165201992 2024-12-27 05:15:44+00:00| seen|...
CVE-2024-12846
creationtimestamp| type| source ---|---|--- 2024-12-21 05:05:36+00:00| seen| https://infosec.exchange/users/cve/statuses/113689069906563464 2024-12-21 05:15:34+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lds5h6jcmv2z 2024-12-21 06:58:14+00:00| seen|...
CVE-2024-43594
creationtimestamp| type| source ---|---|--- 2024-12-10 17:33:56+00:00| seen| https://www.thezdi.com/blog/2024/12/10/the-december-2024-security-update-review 2024-12-10 17:53:46+00:00| seen| https://infosec.exchange/users/cve/statuses/113629799580426668 2025-01-07 16:45:47+00:00| seen|...
CVE-2024-8068
creationtimestamp| type| source ---|---|--- 2024-11-12 16:21:28+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113470897346004162 2024-11-12 19:44:07+00:00| seen| https://t.me/cvedetector/10675 2024-11-12 21:23:09+00:00| seen|...
CVE-2024-48093
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types...
CVE-2024-48093
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types...
CVE-2024-48093
CVE-2024-48093 affects Operately v0.1.0. The vulnerability is an unrestricted file upload in the Discussions tab that allows a privileged user to achieve Remote Code Execution by uploading and executing malicious files without validating file extensions or content types. Public sources in the con...
CVE-2024-6723
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions...
CVE-2024-6723
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions...
CVE-2024-6723 AI Engine < 2.4.8 - Admin+ SQLi
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions...
CVE-2024-6723 AI Engine < 2.4.8 - Admin+ SQLi
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions...
PT-2024-37823 · WordPress · Ai Engine
Name of the Vulnerable Software and Affected Versions: The AI Engine WordPress plugin versions prior to 2.4.8 Description: The issue is related to a SQL injection that occurs due to improper sanitization and escaping of a parameter in a SQL statement. This can be exploited by admin users when...
CVE-2024-42243
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAXPAGECACHEORDER acceptable to xarray Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2. Currently, xarray can't support arbitrary page cache size. More details can be found from t...
CVE-2024-42243 mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAXPAGECACHEORDER acceptable to xarray Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2. Currently, xarray can't support arbitrary page cache size. More details can be found from t...
Security and Human Behavior (SHB) 2024
This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of...
Discourse Security Breach
Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. Discourse suffers from a security vulnerability. An attacker exploiting the vulnerability could learn about the existence of a secret category when setting a contex...
GHSA-FWR2-64VR-XV9M Argo CD cluster secret might leak in cluster details page
Impact Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and...
December’s Reimagining Democracy Workshop
Imagine that weve all--all of us, all of society--landed on some alien planet, and we have to form a government: clean slate. We dont have any legacy systems from the US or any other country. We dont have any special or unique interests to perturb our thinking. How would we govern ourselves? Its...
Celebrating Women’s History Month at Rapid7
Each March, we reflect on the historical accomplishments and ongoing need to support women. This, of course, should be embraced all 12 months of the year, but Women’s History Month gives us a special opportunity to learn from, celebrate, and amplify the voices of women. At Rapid7, we’re shining a...
