CVE-2024-6846

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs...

CVE-2024-6846

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs...

CVE-2024-6846

The CVE-2024-6846 entry concerns the WordPress plugin “Chatbot with ChatGPT” (SmartSearchWP) before 2.4.5. Technical details across connected documents show improper access control on certain REST routes, allowing an unauthenticated user to purge error and chat logs. Affected component: the REST ...

CVE-2024-6846 SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs...

CVE-2024-20440

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

ClamAV 安全漏洞

ClamAV Clam AntiVirus is a free and open source antivirus program from the ClamAV team. The software is used to detect Trojans, viruses, malware and other malicious threats. A security vulnerability exists in ClamAV that stems from allowing the ClamD process to write to its log files under...

PT-2024-38647 · WordPress · Pixelyoursite Pro +1

Name of the Vulnerable Software and Affected Versions: PixelYourSite – Your smart PIXEL TAG & API Manager versions up to and including 9.7.1 PixelYourSite PRO versions up to and including 10.4.2 Description: The vulnerability allows unauthenticated attackers to view potentially sensitive...

Cisco Smart Licensing Utility 安全漏洞

Cisco Smart Licensing Utility CSLU is an application from Cisco USA that allows customers to manage licenses and associated product instances from their local location. A security vulnerability exists in Cisco Smart Licensing Utility that stems from overly detailed logging in debug log files. It...

CVE-2024-38858

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view...

UBUNTU-CVE-2024-38858

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view...

CVE-2024-38858 Cross-site scripting in Robotmk logs view

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view...

CVE-2024-38858 Cross-site scripting in Robotmk logs view

Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view...

CVE-2024-38858

CVE-2024-38858 affects Checkmk versions before 2.3.0p14. The vulnerability is due to improper neutralization of user input in the Robotmk logs view, enabling an attacker to inject and execute malicious scripts. The issue is characterized as a cross-site scripting risk observed in multiple sources...

CVE-2024-8365

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

CVE-2024-8365 Vault Leaks AppRole Client Tokens And Accessor in Audit Log

Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being...

PT-2024-6383

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.17.5 HashiCorp Vault Enterprise versions prior to 1.17.5 and 1.16.9 Description The issue is related to the storage of client tokens and token accessors in plaintext in the audit log due to the removal of...

PT-2024-28239 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p14 Description: The issue is related to improper neutralization of input in Checkmk, allowing attackers to inject and run malicious scripts in the Robotmk logs view. This could potentially lead to arbitrary cod...

HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞

HashiCorp Vault Enterprise and HashiCorp Vault Community Edition are both products of HashiCorp, Inc. of the U.S.A. HashiCorp Vault Enterprise is an enterprise information archiving platform.HashiCorp Vault HashiCorp Vault Enterprise is an enterprise information archiving platform, and HashiCorp...

Dahua DVR Authentication Bypass Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule %qDahua DVR Auth Bypass Scanner, 'Description' = %qScans for Dahua-based DVRs and then grabs settings. Optionally resets a user's password and...

Vault Leaks Client Token and Token Accessor in Audit Devices

Summary Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors...