WordPress Login As Users Plugin <= 1.4.2 is vulnerable to Privilege Escalation

Software Login As Users Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-43311 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 61576dd70a4f Credits John Blackbourn Required...

Siemens SCALANCE M-800 Series Configuration Error Vulnerability

SCALANCE M-800, MUM-800, S615, RUGGEDCOM RM1224 are all industrial routers. A misconfiguration vulnerability exists in the Siemens SCALANCE M-800 series that stems from not properly enforcing isolation between user sessions in its web server component, which can be exploited by an authenticated,...

CVE-2021-26367

A malicious attacker in x86 can misconfigure the Trusted Memory Regions TMRs, which may allow the attacker to set an arbitrary address range for the TMR, potentially leading to a loss of integrity and availability...

WordPress PDF Builder for WPForms Plugin <= 1.2.116 is vulnerable to Full Path Disclosure (FPD)

Software PDF Builder for WPForms Type Plugin Vulnerable versions = 1.2.116 Fixed in 1.2.117 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-7414 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c08822324936 Credits stealthcopt...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

CVE-2024-41475

CVE-2024-41475 affects Gnuboard g6 6.0.7. Vulnerable due to a misconfigured CORS policy that can enable session hijacking, potentially exposing user sessions (high/critical impact per sources). Remediation: fix CORS configuration to properly restrict cross-origin access; consider restricting acce...

Gnuboard 安全漏洞

Gnuboard is a suite of extensible forum programs from the Gnuboard open source. A security vulnerability exists in Gnuboard g6 version 6.0.7, which stems from a CORS misconfiguration that makes it vulnerable to session hijacking...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

WordPress Easy PayPal Buy Now Button Plugin <= 1.9 is vulnerable to Open Redirection

Software Easy PayPal Buy Now Button Type Plugin Vulnerable versions = 1.9 Fixed in 1.9.1 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2024-43236 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 1373cfd80ec3 Credits stealthcopter Require...

WordPress Shared Files Plugin <= 1.7.28 is vulnerable to Sensitive Data Exposure

Software Shared Files Type Plugin Vulnerable versions = 1.7.28 Fixed in 1.7.29 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-43230 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID 9e141e472eac Credits Abdi Pranata Required privile...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, related to incorrect session expiration times, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Flowise Cors Misconfiguration in packages/server/src/index.ts

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...

GHSA-66F2-XXGM-F6XP Flowise Cors Misconfiguration in packages/server/src/index.ts

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22169

CVE-2024-22169 affects WD Discovery. Versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could enable code execution by abusing the ELECTRON_RUN_AS_NODE environment variable. The attack requires the victim to have the WD Discovery app installed; exploitat...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-31201

A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIPScrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine...

CVE-2024-31201

A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIPScrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine...