7100 matches found
CVE-2024-36450
Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may b...
WordPress Team Members Plugin <= 5.3.3 is vulnerable to Cross Site Scripting (XSS)
Software Team Members Type Plugin Vulnerable versions = 5.3.3 Fixed in 5.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38670 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f0e47f407025 Credits Jean Tirstan T Required privilege...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-23692 Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability CVE-2024-38080 Microsoft Windows Hyper-V...
Microsoft Azure DevOps Server Security Vulnerability
Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as code sharing, work tracking, and software distribution. A security vulnerability exists in Microsoft Azure DevOps Server. An attacker exploits...
CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the...
CVE-2024-36991
creationtimestamp| type| source ---|---|--- 2024-07-06 00:54:38+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7885 2024-07-06 07:49:45+00:00| published-proof-of-concept| https://t.me/proxybar/2152 2024-07-06 11:33:13+00:00| published-proof-of-concept| https://t.me/lostsec/756...
CVE-2024-36401
creationtimestamp| type| source ---|---|--- 2024-07-03 15:43:33+00:00| published-proof-of-concept| https://t.me/HackingInsights/4617 2024-07-04 13:46:58+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7863 2024-07-04 16:31:10+00:00| published-proof-of-concept|...
WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Backdoor
Software alfred24 Click & Collect Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cf5f2b39e0cf Credits Sansec.io Required privilege Unauthenticated Published 3...
Prototype Pollution
@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...
CVE-2024-37905
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...
WordPress Slider Revolution Plugin <= 6.7.13 is vulnerable to Cross Site Scripting (XSS)
Software Slider Revolution Type Plugin Vulnerable versions = 6.7.13 Fixed in 6.7.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37449 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 0c45389d2eaa Credits wcraft Required privilege Administrator...
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-24816 GeoSolutionsGroup JAI-EXT Code Injection Vulnerability CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability CVE-2020-13965 Roundcube Webmail...
F5 BIG-IP Exploited in Three-Year Espionage Campaign by Velvet Ant
...
WordPress Book Landing Page Theme <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)
Software Book Landing Page Type Theme Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37230 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b75fbc99c1f0 Credits Dhabaleshwar Das...
EZ-Suite EZ-Partner Security Vulnerability
EZ-Suite EZ-Partner is a customer management system from EZ-Suite, Inc. A security vulnerability exists in EZ-Suite EZ-Partner 5. An attacker exploited the vulnerability to perform a cross-site scripting attack...