8905 matches found
CVE-2024-31452 OpenFGA Authorization Bypass
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion e.g. a but not b or intersection e.g. ...
Sensitive Information Disclosure
OpenTelemetry.Instrumentation.AspNetCore and OpenTelemetry.Instrumentation.Http are vulnerable to Sensitive Information Disclosure. The vulnerability is due to the url.full attribute/tag on spans Activity writing the raw query string to logs, which can potentially expose sensitive data such as En...
CVE-2024-3774
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values...
CVE-2024-3774
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values...
ROS-20240412-06
A vulnerability in the OpenSSL library's implementation of the SM2 cryptographic algorithm is related to buffer copying without checking the size of the input data. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by transmitting specially crafte...
Apple warns people of mercenary attacks via threat notification system
Apple has reportedly sent alerts to individuals in 92 nations on Wednesday, April 10, to say its detected that they may have been a victim of a mercenary attack. The company says it has sent out these types of threat notifications to over 150 countries since the start in 2021. Mercenary spyware i...
Critical RCE Flaw Found in EoL D-Link NAS Devices
...
File Upload Injection
contao/core-bundle is vulnerable to File Upload Injection. The vulnerability is due to inadequate sanitization of filenames during the upload process, which allows users to inject malicious code in filenames, leading to code execution in tooltips and popups in the back end...
Wordpress Plugin Essential Grid 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Contao: Remember-me tokens will not be cleared after a password change
Impact When a front end member changes their password, the corresponding remember-me tokens are not removed. Patches Update to Contao 4.13.40. Workarounds Disable "Allow auto login" in the login module. References...
CVE-2024-28190
Contao core/file management is vulnerable to Cross‑Site Scripting via filenames during file upload. In Contao 4.x and 5.x, versions prior to 4.13.40 and 5.3.4 allow attackers to inject malicious code in uploaded filenames, which is then executed in backend tooltips and popups. Affected versions i...
CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...
April 9, 2024—KB5036893 (OS Builds 22621.3447 and 22631.3447)
None None...
April 9, 2024-Security Only Update for .NET Framework 2.0, 3.0, 3.5 SP1, 4.6.2 for Windows Server 2008 SP2 (KB5037128)
April 9, 2024-Security Only Update for .NET Framework 2.0, 3.0, 3.5 SP1, 4.6.2 for Windows Server 2008 SP2 KB5037128 Applies to: Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4.6.2 REMINDER Windows Embedded 7 Standard and Windo...
April 9, 2024—KB5036892 (OS Builds 19044.4291 and 19045.4291) - EXPIRED
None None...
April 9, 2024—KB5036960 (Monthly Rollup)
None None...
April 9, 2024—KB5036922 (Security-only update)
None None...
April 9, 2024—KB5036969 (Monthly Rollup)
None None...
Contao 代码问题漏洞
Contao is an open source content management system CMS developed in PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao versions prior to 4.13.40, which stems from a token not being cleared after a password change on the front...
Contao 安全漏洞
Contao is an open source content management system CMS developed in PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 4.x prior to version 4.13.40 and version 5.x prior to version 5.3.4, which stems from the fact that...