4632 matches found
Malicious code in agilent.pl29.voldemort.frontend (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-11294 Malicious code in agilent.pl29.voldemort.frontend (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @conundra/components-frontend (npm)
--- -= Per source details. Do not edit below this line.=-...
PT-2024-17008 · WordPress · Feedpress Generator – External Rss Frontend Customizer
Name of the Vulnerable Software and Affected Versions: Feedpress Generator – External RSS Frontend Customizer plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization...
Exploit for CVE-2024-42327
PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on...
Vulnerabilities fixed in Zabbix
Zabbix has fixed vulnerabilities in the Zabbix server and frontend. The vulnerabilities include a stack buffer overflow in the zbxsnmpcachehandleengineid function, which can lead to execution of arbitrary code or a denial of service. In addition, there is an SQL injection vulnerability that allow...
CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...
CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...
CVE-2024-42327 SQL injection in user.get API
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...
CVE-2024-42327
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...
CVE-2024-42327
A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is availabl...
CVE-2024-42327
CVE-2024-42327 is an authenticated SQL injection in Zabbix via the user.get path (CUser.addRelatedObjects) exploitable by non-admin/API-access users. Public PoCs show time-based SQLi leakage of user data and, in some variants, admin API tokens and RCE sequences, enabling privilege escalation to Z...
Malicious code in opendevin-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cef774221fcc201d7233921a587ac24de3a810c28e006c75513c79b54b9999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11060 Malicious code in opendevin-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cef774221fcc201d7233921a587ac24de3a810c28e006c75513c79b54b9999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10981 Malicious code in isc-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in isc-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: media: xc2028: Avoid use-after-free in loadfirmwarecb Syzkaller reported a use-after-free in loadfirmwarecb 1. The reason is that the module allocated a struct tuner in tunerprobe, and then the module initialization failed, causi...
Flowise OverrideConfig security vulnerability
Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...