Bruno IDE Desktop Command Injection

A command injection vulnerability in the function shell.openExternal of Bruno IDE Desktop prior to version 1.29.0 allows attackers to execute arbitrary commands by supplying a crafted URL, leading to potential remote code execution. ===== Tempest Security Intelligence - ADV-10/2024...

Bruno IDE Desktop Command Injection Vulnerability

Bruno IDE Desktop prior to 1.29.0 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents ================================================== Overview Detailed Description Timeline of Disclosure Thanks & Acknowledgements References =====...

CVE-2025-22152

Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack...

CVE-2025-22152 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos

Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack...

CVE-2025-22152 Improper Path Validation Enables Path Traversal in Multiple Components in Atheos

Atheos is a self-hosted browser-based cloud IDE. Prior to v600, the $path and $target parameters are not properly validated across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. These vulnerabilities can be exploited through various attack...

Drupal Entity Form Steps module < 1.1.4 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Ide Braakman in WordPress Module Entity Form Steps versions 1.1.4...

CVE-2024-53768

CVE-2024-53768 describes an exposure of sensitive system information in the WordPress plugin/content module “Content Audit Exporter” (versions up to 1.1). The issue is categorized as a sensitive information exposure that can allow an unauthorized actor to retrieve embedded sensitive data. Public ...

CVE-2024-53768 WordPress Content Audit Exporter plugin <= 1.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows Retrieve Embedded Sensitive Data.This issue affects Content Audit Exporter: from n/a through = 1.1...

CVE-2024-48645

In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization CWE-862 allows any user to modify "function" files used by the game when installed on a dedicated server...

CVE-2024-48645

In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization CWE-862 allows any user to modify "function" files used by the game when installed on a dedicated server...

CVE-2024-48645

In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization CWE-862 allows any user to modify "function" files used by the game when installed on a dedicated server...

CVE-2024-48645

CVE-2024-48645 affects the Minecraft mod Command Block IDE (versions up to and including 0.4.9). The root cause is missing authorization (CWE-862) that lets any user on a dedicated server modify the mod’s game function files. Multiple connected records corroborate the basic vulnerability details ...

Command Block IDE 安全漏洞

Command Block IDE is a command line program for arm32x personal developers. A security vulnerability exists in Command Block IDE version 0.4.9 and earlier, which stems from a lack of authorization and allows any user to modify the function file used by the game when installed on a dedicated serve...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.16.0 release

Red Hat OpenShift Dev Spaces 3.16 has been released. All containers have been updated to include feature enhancements, bug fixes and CVE fixes. Following the Red Hat Product Security standards this update is rated as having a security impact of Important. The Common Vulnerability Scoring System...

JVN#08342147: WindLDR and WindO/I-NV4 store sensitive information in cleartext

PLC programming software "WindLDR" and Operator Interfaces' Touchscreen Programming Software "WindO/I-NV4" provided by IDEC Corporation store sensitive information in cleartext form CWE-312. Impact An attacker who obtained the product's project file may obtain user credentials of the PLC or...

Drupal View Password module < 6.0.4 - Administrator+ Cross Site Scripting (XSS) vulnerability

Administrator+ Cross Site Scripting XSS vulnerability discovered by Ide Braakman in WordPress Module View Password versions 6.0.4...

@appium/universal-xml-plugin (>=1.0.18 <=1.0.20), @cardscan.ai/cardscan-client (>=0.1.0 <=0.4.3) +105 more potentially affected by CVE-2024-41818 via fast-xml-parser (>=4.3.5 <=4.4.0)

fast-xml-parser NPM version =4.3.5, =1.0.18, =0.1.0, =1.1.0, =8.0.167, =11.49.0, =13.4.12, =11.49.0, =28.16.23, =11.49.0, =0.0.145, =1.0.0, =10.3.11, =0.1.11, =8.0.167, =5.0.167, =5.0.200 and more Source cves: CVE-2024-41818 Source advisory: OSV:GHSA-MPG4-RC92-VX8V...

RLSA-2024:2962 Moderate: virt:rhel and virt-devel:rhel security and enhancement update

Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the...

Oracle Linux 9 : qemu-kvm (ELSA-2024-12407)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12407 advisory. - ui/clipboard: add asserts for update and request Fiona Ebner Orabug: 36323175 CVE-2023-6683 - ui/clipboard: mark type as not available when there is...

RHEL 7 : qemu-kvm-rhev (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Qemu: ps2: information leakage via postload routine CVE-2017-16845 - QEMU aka Quick Emulator built with a...