CVE-2024-0349

A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an...

GitLab 8.9 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39869)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project. CVE-2021-39869 Note that Nessus has not tested for this issue but has instead...

CVE-2023-47883

The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity...

CVE-2023-47883

The CVE-2023-47883 issue affects the com.altamirano.fabricio.tvbrowser TV browser app for Android (versions through 4.5.1). Affected component: MainActivity exposed to an explicit intent, enabling JavaScript code execution. Impact is high (CVE scoring shows critical severity, vector: network, no ...

vlady-mix TV Browser Security Vulnerability

vlady-mix TV Browser is a web browser for Android TV from vlady-mix. A security vulnerability exists in vlady-mix TV Browser version 4.5.1 and earlier, which stems from an exposed MainActivity and can be exploited by an attacker to execute JavaScript code...

CVE-2023-47883

The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ Remote...

The vulnerability of the Welcart eCommerce plugin for the WordPress content management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Welcart eCommerce plugin for the WordPress content management system is related to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow an attacker who operates remotely to gain unauthorized access to protected...

PT-2023-8150 · Voltronic Power · Voltronic Power Viewpower

Name of the Vulnerable Software and Affected Versions: Voltronic Power ViewPower affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this issue...

(0Day) Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in that an administrator must trigger a shutdown operation. The specific flaw exists within the shutdown...

(0Day) Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MonitorConsole class. The issue results from an exposed...

PT-2023-8149 · Voltronic Power · Voltronic Power Viewpower

Name of the Vulnerable Software and Affected Versions: Voltronic Power ViewPower affected versions not specified Description: The issue is related to the use of dangerous methods or functions in the LinuxMonitorConsole class of the Voltronic Power ViewPower software. This allows remote attackers ...

PT-2023-8152 · Voltronic Power · Voltronic Power Viewpower

Name of the Vulnerable Software and Affected Versions: Voltronic Power ViewPower affected versions not specified Description: This issue allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. Authentication is not required to exploi...

(0Day) Voltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2023-15420 · Unknown · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker – Popup for opt-ins, lead gen, & more versions 1.17.1 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This can potentially lead to unauthorized access to confidentia...

PT-2023-32756

Name of the Vulnerable Software and Affected Versions Clone WordPress plugin versions prior to 2.4.3 Description The Clone WordPress plugin uses buffer files to store in-progress backup information at a publicly accessible, statically defined file path. This issue potentially affects 90,000 sites...

CVE-2023-5384

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...

MongoDB Breach Update: Names, Emails Exposed, Atlas Secured

By Waqas MongoDB updated its status alert page with new details about the incident on December 17, 2023, at 9:00 PM EST. This is a post from HackRead.com Read the original post: MongoDB Breach Update: Names, Emails Exposed, Atlas Secured...

CVE-2023-6839

Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response...

Schneider Electric C-Bus Toolkit TransferCommand Exposed Dangerous Method Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric C-Bus Toolkit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TransferCommand command. The issue results from an exposed dangerou...