17765 matches found
MAL-2024-4175 Malicious code in Be.Vlaandеren.Basіsregisters.PаrcelRegistrу.Api.CrabImport (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-4284 Malicious code in Be.Vlаanderen.Basisregisters.StreetNameRеgistry.Api.Oslo (NuGet)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3841 Malicious code in @expue/vue3-renderer (npm)
--- -= Per source details. Do not edit below this line.=-...
HackerOne: Business Logic error leads to bypass 2FA requirement
Vulnerability description not provided...
CVE-2024-38895
WAVLINK WN551K1'livemfg.shtml enables attackers to obtain sensitive router information...
The Ultimate Guide To Buying A Server For Your Small Business
Purchasing a server might be difficult. This is particularly valid for those making their first purchase. There will…...
Fickle Stealer’s Dynamic Attack Strategies
...
BELL-CVE-2024-38628
Bulletin has no description...
CVE-2024-6239
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service...
CVE-2023-49112 Insecure Direct Object Reference in Kiuwan SAST
Kiuwan provides an API endpoint /saas/rest/v1/info/application to get information about any application, providing only its name via the "application" parameter. This endpoint lacks proper access control mechanisms, allowing other authenticated users to read information about applications, even...
CVE-2024-5213 Exposure of Sensitive Information in mintplex-labs/anything-llm
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login POST /api/request-token and after account creations POST /api/admin/users/new. This exposure occurs because the entire User object,...
CVE-2022-48726
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Protect mc during concurrent multicast leaves Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked. BUG: KASAN: use-after-free in...
CVE-2024-38428
A flaw was found in wget. Incorrect handling of semicolons in the userinfo subcomponent of a URI allows it to be misinterpreted as part of the host subcomponent, potentially exposing user credentials. Mitigation Make sure to not add semicolons in the userinfo subcomponent of a URI...
CVE-2024-37891
A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects. Mitigation Mitigation for this...
CVE-2024-4032
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and...
CVE-2024-31870
IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in...
CGA-HFQ8-FHQG-QHQX
Bulletin has no description...
CVE-2024-5967
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access permission manage-realm to change the LDAP host URL "Connection URL"...
CVE-2024-3073 Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possibl...