CVE-2024-53450

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents...

CVE-2023-50884

creationtimestamp| type| source ---|---|--- 2024-12-09 14:31:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113623347299417569...

CVE-2023-50882

creationtimestamp| type| source ---|---|--- 2024-12-09 14:31:29+00:00| seen| https://infosec.exchange/users/cve/statuses/113623347284949068...

CVE-2023-49861

creationtimestamp| type| source ---|---|--- 2024-12-09 14:01:27+00:00| seen| https://infosec.exchange/users/cve/statuses/113623229203673172...

CVE-2023-49835

Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through 2.31...

CVE-2024-52385

CVE-2024-52385 affects WordPress Plugin Team Member – Multi Language Supported Team Plugin, with a Local File Inclusion vulnerability in PHP Include/Require due to improper filename handling. Affected versions are reported as up to 7.3 (and up to 7.4 in Patchstack context); required privilege is ...

CVE-2023-30748

CVE-2023-30748 affects WordPress WordPress Easy Appointments plugin, vulnerability: stored XSS due to improper input neutralization during page generation. Applicable to versions

CVE-2024-12307

creationtimestamp| type| source ---|---|--- 2024-12-09 08:55:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113622027548857989 2024-12-09 11:20:46+00:00| seen| https://t.me/cvedetector/12365...

CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

CVE-2024-12349

creationtimestamp| type| source ---|---|--- 2024-12-09 00:31:04+00:00| seen| https://infosec.exchange/users/cve/statuses/113620042610266633 2024-12-09 02:59:06+00:00| seen| https://t.me/cvedetector/12338...

CVE-2024-55582

Oxide before 6 has unencrypted Control Plane datastores...

CVE-2024-11367

creationtimestamp| type| source ---|---|--- 2024-12-07 09:29:15+00:00| seen| https://infosec.exchange/users/cve/statuses/113610834230623764 2024-12-07 11:41:58+00:00| seen| https://t.me/cvedetector/12317...

CVE-2024-12257

creationtimestamp| type| source ---|---|--- 2024-12-07 02:44:50+00:00| seen| https://infosec.exchange/users/cve/statuses/113609244029314690 2024-12-07 04:10:39+00:00| seen| https://t.me/cvedetector/12300...

CVE-2024-12026 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-46874 Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow MQTT clients connecting with device credentials to send messages to some topics. Attackers with device credentials could issue commands to other devices on behalf of Ruijie's cloud...

CVE-2024-48703

PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting XSS in /admin/search-medicalcard.php via the searchdata parameter...

CVE-2024-48868

CVE-2024-48868 is a CRLF injection vulnerability reported to affect QNAP QTS and QuTS hero. The flaw permits remote modification of application data when exploited. Affected versions have been fixed: QTS 5.1.9.2954 build 20241120 and later; QTS 5.2.2.2950 build 20241114 and later; QuTS hero h5.1....

CVE-2024-48867

CVE-2024-48867 concerns CRLF injection in QNAP QTS and QuTS Hero. Affected products/versions include QTS 5.1.9.2954 (build 20241120) and later, QTS 5.2.2.2950 (build 20241114) and later, QuTS hero h5.1.9.2954 (build 20241120) and later, and QuTS hero h5.2.2.2952 (build 20241116) and later. The CW...

CVE-2024-12254

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

CVE-2024-54137 liboqs has a correctness error in HQC decapsulation

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...