CVE-2024-9687 WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-6763

A flaw was found in Jetty. The HttpURI class performs insufficient validation on the authority segment of a URI. The HttpURI and the browser may differ on the value of the host extracted from an invalid URI. This combination of Jetty and a vulnerable browser may be vulnerable to an open redirect...

PT-2024-8548

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description The HttpURI class in Eclipse Jetty does insufficient validation on the authority segment of a URI, which can lead to differences in how it handles invalid URIs compared to common...

Mageia: Security Advisory (MGASA-2024-0321)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated chromium-browser-stable packages fix security vulnerabilities

Use after free in Downloads. CVE-2024-6988 Use after free in Loader. CVE-2024-6989 Use after free in Dawn. CVE-2024-6991 Heap buffer overflow in Layout. CVE-2024-6994 Inappropriate implementation in Fullscreen. CVE-2024-6995 Race in Frames. CVE-2024-6996 Use after free in Tabs. CVE-2024-6997 Use...

MGASA-2024-0321 Updated chromium-browser-stable packages fix security vulnerabilities

Use after free in Downloads. CVE-2024-6988 Use after free in Loader. CVE-2024-6989 Use after free in Dawn. CVE-2024-6991 Heap buffer overflow in Layout. CVE-2024-6994 Inappropriate implementation in Fullscreen. CVE-2024-6995 Race in Frames. CVE-2024-6996 Use after free in Tabs. CVE-2024-6997 Use...

Cross Site Scripting(XSS)

librenms/librenms is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient input validation or sanitization of the "hostname" parameter in the "Device Dependencies" feature, allows attackers to inject arbitrary JavaScript, which can then be stored and executed in...

CVE-2024-45872

Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub0x410d1d. The vulnerability occurs due to insufficient validation of PSD files...

CVE-2024-20492 Cisco Expressway Series Privilege Escalation Vulnerability

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level...

CVE-2024-45920

CVE-2024-45920 describes a Stored XSS in Solvait 24.4.2, arising from insufficient input validation/sanitization in the Intrest feature. The vulnerability could allow remote attackers to inject scripts into the application, with the CVSS 3.1 base score reported as 5.4 (Medium) and an attack vecto...

PT-2024-9360 · Sap +1 · Sap Netweaver As Java +1

Name of the Vulnerable Software and Affected Versions: Adobe Document Service affected versions not specified SAP NetWeaver AS for Java affected versions not specified Description: The issue is related to a Server-Side Request Forgery vulnerability in Adobe Document Service, which can be exploite...

Cross-site Scripting (XSS)

The camaleoncms is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation in the image upload functionality, allowing normal registered users to upload SVG images containing JavaScript or upload HTML documents by manually altering the format parameter. If an...

Stack Overflow

Google Protobuf is vulnerable to a StackOverflow. The vulnerability is due to insufficient validation and control over the parsing of nested groups and SGROUP tags in untrusted Protocol Buffers data, allowing an attacker to crash the application or make it unresponsive...

Arbitrary Code Execution

mautic/core is vulnerable to Arbitrary Code Execution. The vulnerability is due to insufficient validation and access control during the execution of the upgrade script, allowing an attacker to execute arbitrary code during the upgrade process...

The vulnerability of the Downloads component in Microsoft Edge and Google Chrome browsers allows a perpetrator to compromise data integrity.

The vulnerability of the Downloads component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to compromise data integrity through a specially crafted HTML page...

Directory Traversal

contao/core-bundle is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation or restriction of file paths in the FileSelector widget, allowing authenticated users to access directories outside the intended document root...

CVE-2022-39068 Buffer Overflow Vulnerability in ZTE MF296R

There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack...

The vulnerability of the Zimbra Collaboration Suite’s email management system, which stems from insufficient validation of incoming requests, allows attackers to carry out SRF attacks.

The vulnerability of the Zimbra Collaboration Suite’s email management system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a SRF attack remotely...

CVE-2024-8761 Share This Image <= 2.03 - Open Redirect via link Parameter

The Share This Image plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.03. This is due to insufficient validation on the redirect url supplied via the link parameter. This makes it possible for unauthenticated attackers to redirect users to potentially...

CVE-2024-8761

The CVE-2024-8761 entry describes an Open Redirect in the WordPress plugin Share This Image for versions up to 2.03, caused by insufficient validation of the link parameter. This enables unauthenticated attackers to redirect users to potentially malicious sites. Remediation: upgrade to version 2....