CVE-2024-48897 Moodle: idor in edit/delete rss feed

A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify...

PT-2024-35381 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.1 Description: Autolab is a course management service that enables auto-graded programming assignments. There is an issue where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class...

Farmacia 注入漏洞

Farmacia is a content management system from code-projects. An injection vulnerability exists in Farmacia version 1.0, which stems from an SQL injection vulnerability contained in the id parameter of the /editar-produto.php file...

PT-2024-34659 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the overwrite ip parameter when editing a device. Th...

The vulnerability of Adobe After Effects’ video and dynamic image editing software arises from operations that go beyond buffer boundaries in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the execution of operations beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

PDF Viewer Macro 安全漏洞

PDF Viewer Macro is an open source macro for XWiki SAS. It allows viewing PDF files attached to XWiki pages from within the XWiki page. A security vulnerability exists in PDF Viewer Macro prior to version 2.5.6, which stems from the width parameter of the PDF Viewer Macro not being properly...

MAL-2024-10822 Malicious code in feature-preserve-portrait-editing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 655ca5fa8c26583d141a0d6f86c0bca2e156cbad062d86ff11ec6827d2ac9cf7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in feature-preserve-portrait-editing (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 655ca5fa8c26583d141a0d6f86c0bca2e156cbad062d86ff11ec6827d2ac9cf7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents allows a hacker to restart the application.

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents is related to incorrect processing of character definitions during SNMP configuration. Exploiting this vulnerability could allow a malicious actor to remotely restart the application...

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents allows a perpetrator to enable debugging functions.

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents is related to the presence of undocumented configuration commands. Exploiting this vulnerability could allow an attacker to enable debugging functions...

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents allows a perpetrator to influence the confidentiality of the protected information.

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the confidentiality of the protected information...

PT-2024-16248 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.35.1 Description: The issue arises from a missing capability check on a function, allowing authenticated attackers...

Cross-site Scripting (XSS)

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper handling of slugs on the article editing screen. An attacker can manipulate the output of the page by injecting malicious...

CVE-2024-20274

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due ...

CVE-2024-20274 Cisco Secure Firewall Management Center HTML Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software, formerly Firepower Management Center Software, could allow an authenticated, remote attacker to inject arbitrary HTML content into a device-generated document. This vulnerability is due ...

UBUNTU-CVE-2022-4973

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into...

SolarWinds Platform 跨站脚本漏洞

SolarWinds Platform is a unified monitoring, observability, and service management platform from U.S.-based SolarWinds, Inc. A cross-site scripting vulnerability exists in SolarWinds Platform versions 2024.2.1 and earlier, which stems from the vulnerability to cross-site scripting when performing...

OESA-2024-2236 xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals. Security Fixes: xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the...

CVE-2024-7041 IDOR in open-webui/open-webui

An Insecure Direct Object Reference IDOR vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint http://0.0.0.0:3000/api/v1/memories/id/update, where the decentralization design is flawed, allowing attackers to edit other users' memories without...

DRUPAL-CONTRIB-2024-048

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not sufficiently protect some routes against a Cross Site Request Forgery attack. This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the...