ROS-20240826-17

Vulnerability in DecodeConfig component of Golang programming language is related to uncontrolled consumption of resources. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial-of-service condition. denial of service Vulnerability of...

CVE-2024-6499 WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other...

CVE-2024-6499: Exposure of Sensitive Information to an Unauthorized Actor

The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other...

SUSE CVE-2022-48913

In the Linux kernel, the following vulnerability has been resolved: blktrace: fix use after free for struct blktrace When tracing the whole disk, 'dropped' and 'msg' will be created under 'q-debugfsdir' and 'bt-dir' is NULL, thus blktracefree won't remove those files. What's worse, the following...

PT-2024-27470 · Collabora · Collabora Online

Name of the Vulnerable Software and Affected Versions: Collabora Online versions prior to 22.05.23.1 Collabora Online versions prior to 23.05.14.1 Collabora Online versions prior to 24.04.4.3 Description: In affected versions of Collabora Online, a collaborative online office suite based on...

PT-2024-31517

Name of the Vulnerable Software and Affected Versions GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 version 4.6.2 Description An issue was discovered that allows users who belong to unauthorized groups to invoke any interface of the device, thereby gaining complete contro...

CVE-2020-11847

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847 Vulnerability in sshrelay in privileged access manager provides full system access.

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847

CVE-2020-11847 affects OpenText NetIQ Privileged Account Manager (PAM) prior to 3.7.0.1. An SSH-authenticated user can access the PAM server and run an OS command via bash to obtain full system access. The root cause is exposure of command execution during SSH access to the PAM server, as describ...

CVE-2024-6568

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

CVE-2024-6568

CVE-2024-6568 affects Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress (versions ≤ 3.1.0). It exposes Full Path Disclosure due to mobiledetect access not being restricted, enabling unauthenticated retrieval of the web root path. This is a low- to medium-severity issue (CVSS v...

CVE-2024-6568 Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

CVE-2024-6568 Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

WordPress plugin Flamix 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2020-11847: Improper Neutralization of Special Elements used in an OS Command

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2024-6568: Exposure of Sensitive Information to an Unauthorized Actor

The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated...

PT-2024-37724 · WordPress +1 · The Flamix +1

Name of the Vulnerable Software and Affected Versions: The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress versions up to, and including, 3.1.0 Description: The plugin is vulnerable to Full Path Disclosure due to its utilization of mobiledetect without preventing direct acce...

The vulnerability in the full-screen notification mode of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird allows a hacker to perform spoofing attacks.

The vulnerability in the full-screen notification mode of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird is related to an improper limitation on the number of user interface layers or frames displayed. Exploiting this vulnerability allows a malicious actor to perfo...

CVE-2024-7411

The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing direct access to the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php. This makes it possible for unauthenticated attackers to...

CVE-2024-7411 Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure

The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing direct access to the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php. This makes it possible for unauthenticated attackers to...