CVE-2023-40501 LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2023-40501

Summary: CVE-2023-40501 affects LG Simple Editor. The flaw is in the implementation of the copyContent command, caused by an exposed dangerous function, allowing remote attackers to execute code in the SYSTEM context with no authentication over the network. Multiple connected sources (ZDI advisor...

LG Simple Editor 安全漏洞

LG Simple Editor is a simple editor from Luckin LG Korea that creates new content by simplifying the process and instant playback on signage. A remote code execution vulnerability exists in LG Simple Editor due to an exposed and dangerous feature. An attacker could exploit the vulnerability to...

PT-2024-25718 · Jenkins · Jenkins Telegram Bot Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Telegram Bot Plugin versions 1.4.0 and earlier Description: The issue concerns the storage of the Telegram Bot token in an unencrypted manner within the global configuration file on the Jenkins controller. This file can be accessed by...

PT-2024-27354 · WordPress · Drag/Drop Multiple File Upload – Contact Form 7

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress versions up to, and including, 1.3.7.7 Description: The issue allows unauthenticated attackers to extract sensitive data uploaded via the plugin through a form. This is...

CVE-2024-30176

In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets...

CVE-2024-30176

CVE-2024-30176 affects Logpoint versions prior to 7.4.0. The issue allows an attacker to enumerate a valid list of usernames by using publicly exposed URLs of shared widgets, representing an information disclosure vulnerability. The root cause is exposure of widget URLs that enable username enume...

CVE-2024-30176

In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets...

North Koreans Secretly Animated Amazon and Max Shows, Researchers Say

Thousands of exposed files on a misconfigured North Korean server hint at one way the reclusive country may evade international sanctions...

CVE-2023-6897

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'algwceanproductmeta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2024-27537 · Electrolink · Electrolink Transmitters

Name of the Vulnerable Software and Affected Versions: Electrolink transmitters affected versions not specified Description: The issue concerns Electrolink transmitters storing credentials in clear-text, which could allow an attacker to access the system using these credentials. Recommendations: ...

PT-2024-4304 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain unauthorized access to protected information. ...

PT-2024-3511 · Amd · Amdpspp2Cmboxv2

Name of the Vulnerable Software and Affected Versions: AmdPspP2CmboxV2 affected versions not specified Description: The issue is related to an exposed SMI handler in AmdPspP2CmboxV2, which can be leveraged to bypass protections put in place by previous UEFI phases, allowing direct access to the S...

CVE-2024-30614

An issue in Ametys CMS v4.5.0 and before allows attackers to obtain sensitive information via exposed resources to the error scope...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

VulnCheck KEV: CVE-2024-20767

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel...

CVE-2024-1289 LearnPress <= 4.2.6.3 - Insecure Direct Object Reference

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to...

PT-2024-15087 · WordPress · Wp Reset – Most Advanced Wordpress Reset Tool

Name of the Vulnerable Software and Affected Versions: The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress versions up to, and including, 2.0 Description: The issue allows unauthenticated attackers to extract sensitive data, including site backups, by brute-forcing snapshot...

LearnPress < 4.2.6.4 - Insecure Direct Object Reference

Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated...