8955 matches found
PT-2024-11695 · WordPress · Security
Name of the Vulnerable Software and Affected Versions: Security, Antivirus, Firewall – S.A.F plugin for WordPress versions up to, and including, 2.3.5 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login...
Wordpress LiteSpeed Cache plugin cookie theft
This module exploits an unauthenticated account takeover vulnerability in LiteSpeed Cache, a Wordpress plugin that currently has around 6 million active installations. In LiteSpeed Cache versions prior to 6.5.0.1, when the Debug Logging feature is enabled, the plugin will log admin cookies to the...
Cisco Smart Licensing Utility 安全漏洞
Cisco Smart Licensing Utility CSLU is an application from Cisco USA that allows customers to manage licenses and associated product instances from their local location. A security vulnerability exists in Cisco Smart Licensing Utility that stems from overly detailed logging in debug log files. It...
CVE-2024-45231
An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome only...
CVE-2022-4539
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539 Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539 Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4539
CVE-2022-4539 concerns the Web Application Firewall plug‑in for WordPress. The vulnerability is an IP Address Spoofing issue affecting versions up to 2.1.2, caused by insufficient restrictions on where IP Address data is retrieved for request logging and login controls. Attackers could supply a m...
CVE-2022-4536
The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
CVE-2022-4536
The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the...
PT-2024-11706 · WordPress · The Ip Vault – Wp Firewall
Name of the Vulnerable Software and Affected Versions: The IP Vault – WP Firewall plugin for WordPress versions up to, and including, 1.1 Description: The issue is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions...
Drupal Full Path Disclosure
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
GHSA-MG8J-W93W-XJGC Drupal Full Path Disclosure
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
CVE-2024-45440
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
UBUNTU-CVE-2024-45440
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
CVE-2024-45440
Summary: CVE-2024-45440 affects Drupal 11.x-dev, where core/authorize.php can disclose full file paths when hash_salt is set to file_get_contents of a non-existent file. Affected components: Drupal 11.x-dev, core/authorize.php. Root cause (as stated): hash_salt evaluated via file_get_contents of ...
CVE-2024-45440
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist...
kernel: wifi: iwlwifi: mvm: don't read past the mfuart notifcation
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the...
CVE-2024-3982
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator...