gilles-hunault.leria-info.univ-angers.fr Cross Site Scripting vulnerability OBB-3872040

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-15463 · Skyhigh +1 · Skyhigh Client Proxy +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A malicious insider exploiting this issue can circumvent existing security controls put in place by the organization. If the victim is using a temporary...

PT-2024-40661 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the pcpp::Packet::createFirstLayer and...

Design/Logic Flaw

yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.8.0 allows users to create a public token in the settings, which can be used to provide guest-level access to the information of that specific user in YourSpotify. The /me API endpoint discloses Spotify A...

CVE-2024-24549

creationtimestamp| type| source ---|---|--- 2024-03-13 17:37:17+00:00| seen| https://t.me/ctinow/206948 2024-03-14 22:56:57+00:00| seen| https://t.me/ctinow/208254 2024-12-09 05:02:48+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/9355 2025-02-13 19:13:25+00:00|...

CVE-2024-1505

The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saveduserinfo function. This makes it possible for...

zaleszany.parafia.info.pl Cross Site Scripting vulnerability OBB-3870718

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

YourSpotify Security Breach

YourSpotify is a self-hosted Spotify tracking dashboard. A security vulnerability exists in versions of YourSpotify prior to 1.8.0 that stems from allowing users to create public tokens in settings that can be used to provide guest-level access to specific user information...

PT-2024-18098 · WordPress · The Academy Lms

Name of the Vulnerable Software and Affected Versions: The Academy LMS – eLearning and online course solution for WordPress plugin versions up to, and including, 1.9.19 Description: The issue is related to privilege escalation due to the plugin allowing arbitrary user meta updates through the sav...

Description of the security update for SharePoint Enterprise Server 2016: March 12, 2024 (KB5002559)

None None...

kernel: Out-Of-Bounds Read vulnerability in smbCalcSize

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information...

Information disclosure

In wipensmemory of nsmemwipe.c, there is a possible incorrect size calculation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-27230

In ProtocolPsKeepAliveStatusAdapter::getCode of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation...

CVE-2024-22007

The Google Pixel smartphone is affected by an out-of-bounds read vulnerability caused by a missing bounds check in the constraint_check function of the fvp.c file. This flaw could lead to local information disclosure without requiring additional execution privileges or user interaction. While the...

Qualcomm rmnet_fill_info() Function Use-After-Free

The vulnerability of the rmnetfillinfo function in the drivers/net/ethernet/qualcomm/rmnet/rmnetconfig.c file, which is part of the MAP protocol implementation in the Qualcomm network card driver for the Linux operating system, relates to memory access beyond the allocated buffer. Exploiting this...

CVE-2019-1476

creationtimestamp| type| source ---|---|--- 2024-03-09 14:46:29+00:00| seen| https://t.me/ctinow/203955...

New Python-Based Snake Info Stealer Spreading Through Facebook Messages

Facebook messages are being used by threat actors to distribute a Python-based information stealer dubbed Snake that's designed to capture credentials and other sensitive data. "The credentials harvested from unsuspecting users are transmitted to different platforms such as Discord, GitHub, and...

CVE-2024-24375

SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter...

PT-2024-40654 · Git +1 · Libaom

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is reported, with a crash type indicating a Heap-buffer-overflow READ 1. The crash state involves functions such as od ...

BIT-GITLAB-2020-13352

Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: =10.2, =13.4, =13.5, 13.5.2...