CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication...

CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication...

CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication...

CVE-2024-54155

JetBrains YouTrack vulnerability CVE-2024-54155 involves improper access control that allowed listing of project names during app import without authentication. Affected software: JetBrains YouTrack (versions prior to 2024.3.51866). Root cause: insufficient access controls during the import flow ...

JetBrains YouTrack 安全漏洞

JetBrains YouTrack is a project management tool developed by JetBrains that supports cloud hosting and local deployment. JetBrains YouTrack suffers from an improper access control vulnerability that stems from allowing project names to be listed without authentication during application import. A...

MAL-2024-12230 Malicious code in catme (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7b5df44af9cbed7b8a7112f36f9c99b466e9143b36d62fd43e4caf480df811d0 Importing the module starts executing a remote script, as well as leaves a persitance in the .bashrc --- Category: MALICIOUS - The campaign has clearly malicio...

Malicious code in byted-df (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 821138aac758315c7a31a463523c4930bdd52e67699199e4c8bda0511c5907f8 Importing the module triggers sending out the hostname to the package author. It looks to be a placeholder/pentest activity related to BytedDance. --- Category...

PT-2024-9169 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.51866 Description: The issue is related to improper access control in JetBrains YouTrack, which allowed listing of project names during app import without authentication. This could potentially allo...

MAL-2024-11094 Malicious code in shopee-ui-automatic-import-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e30109d0ce569668c54f7d030ae4d33fd3858572a05996c3a53877d48629ef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-classification-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf941eb64cb46effcedb0a7bc56e9aa2c3a16f53b93efc19baecb91bc6699f02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10969 Malicious code in eslint-plugin-classification-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf941eb64cb46effcedb0a7bc56e9aa2c3a16f53b93efc19baecb91bc6699f02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

CVE-2024-11672

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature...

CVE-2024-11672

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature...

CVE-2024-11672

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the "Add" permission via the import in vault feature...

CVE-2024-11672

CVE-2024-11672 affects Devolutions Remote Desktop Manager, with incorrect authorization in the Add permission component prior to 2024.2.22 on Windows. An authenticated user could bypass the Add permission via the vault import feature, exposing integrity (LOW) but not confidentiality/availability ...

PT-2024-17180 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2024.2.21 and earlier Description: The issue concerns incorrect authorization in the add permission component, allowing an authenticated malicious user to bypass the "Add" permission via the import ...

Malicious code in webpack-svg-spirit-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e06e486295eccd406df5d378ae3d70ad72e5be5dad6bd5d99fde1d16e324f5af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10890 Malicious code in webpack-svg-spirit-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e06e486295eccd406df5d378ae3d70ad72e5be5dad6bd5d99fde1d16e324f5af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10532

CVE-2024-10532 affects Bard Extra for WordPress. The vulnerability is due to a missing authorization check in the bardxtra_import_xml() function, allowing authenticated users with subscriber-level access and above to import demo data, enabling unauthorized modification of data. Affected versions ...