Microsoft Azure DevOps Server Security Vulnerability

Microsoft Azure DevOps Server is a suite of software development collaboration tools from Microsoft Corporation USA. The product includes features such as code sharing, work tracking, and software distribution. A security vulnerability exists in Microsoft Azure DevOps Server. An attacker exploits...

CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the...

CVE-2024-36991

creationtimestamp| type| source ---|---|--- 2024-07-06 00:54:38+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7885 2024-07-06 07:49:45+00:00| published-proof-of-concept| https://t.me/proxybar/2152 2024-07-06 11:33:13+00:00| published-proof-of-concept| https://t.me/lostsec/756...

CVE-2024-36401

creationtimestamp| type| source ---|---|--- 2024-07-03 15:43:33+00:00| published-proof-of-concept| https://t.me/HackingInsights/4617 2024-07-04 13:46:58+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7863 2024-07-04 16:31:10+00:00| published-proof-of-concept|...

WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Backdoor

Software alfred24 Click & Collect Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cf5f2b39e0cf Credits Sansec.io Required privilege Unauthenticated Published 3...

Prototype Pollution

@amoy/common is vulnerable to Prototype Pollution. The vulnerability is due to functions like extend and setValue, which can be exploited by passing crafted arguments with a proto property. This allows attackers to alter the behavior of all objects inheriting from the affected prototype...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a series of chipsets from Qualcomm, an American company. A security vulnerability exists in Qualcomm Chipsets. An attacker exploited the vulnerability to cause memory corruption...

CVE-2024-37905

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...

WordPress Slider Revolution Plugin <= 6.7.13 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.7.13 Fixed in 6.7.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37449 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 0c45389d2eaa Credits wcraft Required privilege Administrator...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-24816 GeoSolutionsGroup JAI-EXT Code Injection Vulnerability CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability CVE-2020-13965 Roundcube Webmail...

F5 BIG-IP Exploited in Three-Year Espionage Campaign by Velvet Ant

...

WordPress Book Landing Page Theme <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Book Landing Page Type Theme Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37230 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b75fbc99c1f0 Credits Dhabaleshwar Das...

EZ-Suite EZ-Partner Security Vulnerability

EZ-Suite EZ-Partner is a customer management system from EZ-Suite, Inc. A security vulnerability exists in EZ-Suite EZ-Partner 5. An attacker exploited the vulnerability to perform a cross-site scripting attack...

CVE-2024-36680

In the module "Facebook" pkfacebook =1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection...

CVE-2024-36289

CVE-2024-36289 concerns FreeFrom - the nostr client prior to version 1.3.5. The vulnerability arises from reusing a nonce/key pair in encryption, enabling a man-in-the-middle to potentially manipulate the content of direct messages (DMs) between users. Affected platforms include Android and iOS a...

CVE-2024-5659 Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers

Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable faultMNRF/Assert. This vulnerability could be exploited by sending abnormal packets to the mDNS port. If exploited, the availability of the device wou...