markdown-math-editor (>=1.1.0, <=1.1.3), mse-md2html (>=1.0.0, <=1.0.1) +1 more potentially affected by unknown CVE via remark-images-download (3.0.5)

remark-images-download NPM version 3.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on remark-images-download and may be impacted: - markdown-math-editor =1.1.0, =1.0.0, =8.0.0, =12.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-MF74-QQ7W-6J7...

GHSA-MF74-QQ7W-6J7V Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images

Impact A major blind SSRF has been found in remark-images-download, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network 192.168.1.0/24. A private service...

Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images

Impact A major blind SSRF has been found in remark-images-download, which allowed for requests to be made to neighboring servers on local IP ranges. The issue came from a loose filtering of URLs inside the module. Imagine a server running on a private network 192.168.1.0/24. A private service...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

cve-2017-7921-Mass-Exploit Mass Config Download python3 dow...

WordPress Total Upkeep Plugin <= 1.15.8 is vulnerable to Arbitrary File Download

Software Total Upkeep Type Plugin Vulnerable versions = 1.15.8 Fixed in 1.15.9 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-24869 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7a4ce347d2cf Credits Yudistira Arya Required privileg...

Security Bulletin: There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Asset Management application (CVE-2023-25194)

Summary There is a vulnerability in kafka-clients-2.8.2.jar used by IBM Maximo Asset Management application. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserializatio...

CVE-2024-1098

A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The exploit has been disclosed to the public and may b...

Design/Logic Flaw

A vulnerability was found in Rebuild up to 3.5.5 and classified as problematic. This issue affects the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The exploit has been disclosed to the public and may b...

PT-2024-16677 · Rebuild · Rebuild

Name of the Vulnerable Software and Affected Versions: Rebuild versions up to 3.5.5 Description: A vulnerability was found in Rebuild, affecting the function QiniuCloud.getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to information disclosure. The...

Rebuild Information Disclosure Vulnerability

Rebuild is a highly customizable enterprise management system. An information disclosure vulnerability exists in Rebuild 3.5.5 and earlier versions, which stems from a security issue in the QiniuCloud.getStorageFile function in /filex/proxy-download, which leads to information disclosure via the...

WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Email Before Download Type Plugin Vulnerable versions = 6.9.7 Fixed in 6.9.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-23519 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0219cc769beb Credits Mika Required...

CVE-2024-1020 Rebuild proxy-download getStorageFile cross site scripting

A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The exploit has bee...

CVE-2024-1020 Rebuild proxy-download getStorageFile cross site scripting

A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of the file /filex/proxy-download. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The exploit has bee...

PT-2024-16113 · Rebuild · Rebuild

Name of the Vulnerable Software and Affected Versions: Rebuild versions up to 3.5.5 Description: A problematic vulnerability was found in Rebuild. The getStorageFile function of the file /filex/proxy-download is affected. The manipulation of the url argument leads to cross-site scripting. The...

Rebuild Cross-Site Scripting Vulnerability

Rebuild is a highly customizable enterprise management system. A cross-site scripting vulnerability exists in Rebuild version 3.5.5, which stems from a cross-site scripting vulnerability in the url parameter of the getStorageFile function of file /filex/proxy-download...

Security Bulletin: IBM Storage Ceph is vulnerable to Uncontrolled Resource Consumption in Ceph (CVE-2023-46159)

Summary Ceph is used by IBM Storage Ceph as storage. CVE-2023-46159 This bulletin identifies the steps to take to address the vulnerability in Ceph. Vulnerability Details CVEID:CVE-2023-46159 DESCRIPTION: IBM Storage Ceph could allow an authenticated user on the network to cause a denial of servi...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Certificate Validation in the RHEL UBI (CVE-2023-28321)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. CVE-2023-28321 This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. Vulnerability Details CVEID:CVE-2023-28321 DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security...

Security Bulletin: IBM Maximo Spatial Asset Management is vulnerable to Blind Server-Side Request Forgery (CVE-2023-32337)

Summary IBM Maximo Spatial Asset Management is vulnerable to Blind Server-Side Request Forgery Vulnerability Details CVEID:CVE-2023-32337 DESCRIPTION: IBM Maximo Spatial Asset Management is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthoriz...

Path traversal

A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the argument name with the input...

CVE-2024-0882 qwdigital LinkWechat Universal Download Interface resource path traversal

A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the argument name with the input...