17606 matches found
CVE-2024-37279
A flaw was discovered in Kibana, allowing read-only alerting users using the runsoon API making the alerting rule run continuously. This issue potentially affects the system if the alerting rule is running complex queries...
Cross-Site Scripting in third party library mso/idna-convert
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3src sources folder in the document root...
CVE-2024-5222
CVE-2024-5222: Stored XSS in the Responsive Addons WordPress plugin via the file uploader; affects all versions up to 3.0.5 and requires authentication (Author level or higher). A patch/update is available per connected disclosures; apply the vendor/maintainer update to remediate.
CVE-2022-28658
CVE-2022-28658 concerns the Apport component of Ubuntu/Linux, where argument parsing mishandles filename splitting on older kernels, enabling local argument spoofing to the Apport daemon. The issue affects Apport’s handling of certain filenames and command-line arguments, with the published CVSS ...
CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
CVE-2023-1419
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data...
CVE-2024-34797
CVE-2024-34797 is a Stored XSS in the WordPress plugin “Simple Popup Manager” by Benoit Mercusot. The vulnerability affects Simple Popup Manager versions from n/a up to 1.3.5, caused by improper input neutralization during web page generation. The CVE entry provides a CVSS v3.1 base score of 5.9 ...
CVE-2024-35633
CVE-2024-35633 is a Server-Side Request Forgery (SSRF) vulnerability in CreativeThemes Blocksy Companion for WordPress, affecting Blocksy Companion versions up to 2.0.42. The affected condition requires Administrator-level access; the issue is exploitable via network-based vectors and impacts con...
CVE-2024-5311
CVE-2024-5311 affects DigiWin EasyFlow .NET. The vulnerability arises from insufficient validation of certain input parameters, allowing an unauthenticated remote attacker to inject arbitrary SQL commands that can read, modify, and delete database records. The issue is rated CVSS v3.1 base score ...
CVE-2024-22058
Ivanti Endpoint Manager (EPM) versions 2021.1 and older are affected by a local buffer overflow vulnerability. A low-privilege user who has the EPM Agent installed on the local machine can potentially execute arbitrary code with elevated permissions. The public documents consistently describe the...
CVE-2024-5565
CVE-2024-5565 concerns the Vanna.AI library (Python) where prompt injection in the library’s ask API, with visualize set to True, can execute arbitrary Python code on the host, enabling remote code execution. The vulnerability arises from insufficient input validation in the prompt generation tha...
CVE-2024-36950
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until busresetwork has serviced and cleared the...
CVE-2024-4741
A use-after-free vulnerability was found in OpenSSL. Calling the OpenSSL API SSLfreebuffers function may cause memory to be accessed that was previously freed in some situations. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat...
Hackers Claim Ticketmaster Data Breach: 560M Users’ Info for Sale at $500K
By Waqas ShinyHunters hacking group has claimed to have breached Ticketmaster, stealing the personal data of 560 million users. The… This is a post from HackRead.com Read the original post: Hackers Claim Ticketmaster Data Breach: 560M Users Info for Sale at $500K...
CVE-2024-36112
CVE-2024-36112 affects Nautobot: in 1.3.0–1.6.22 and 2.0.0–2.2.4, listing members of Dynamic Groups via the UI or API does not enforce member-object permissions, enabling a user with extras.view_dynamicgroup to see all Group members regardless of dcim.view_device. Fixed in Nautobot 1.6.23 and 2.2...
CVE-2024-23580
The CVE-2024-23580 entry concerns HCL DRYiCE Optibot Reset Station. Affected component: the OTP handling/encryption mechanism, where insecure encryption could allow an attacker with database access to recover some or all encrypted OTP values. Documented impact focuses on confidentiality (HIGH) wi...
GHSA-8FMJ-33GW-G7PW Denial of service of Minder Server from maliciously crafted GitHub attestations
Minder is vulnerable to a denial-of-service DoS attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on th...
CVE-2024-30212 Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
If a SCSI READ10 command is initiated via USB using the largest LBA 0xFFFFFFFF with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed. The same method works to wri...
CVE-2024-33805
The CVE-2024-33805 issue affects Campcodes Complete Web-Based School Management System 1.0, specifically the /model/get_student.php endpoint. A SQL injection via the id parameter is used to execute arbitrary SQL commands, enabling high-severity impact on confidentiality, integrity, and availabili...