Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a condition that is not properly checked and could lead to misconfiguration...

The vulnerability of the driver responsible for the computer’s interaction with the CLFS.sys device in the Windows operating system allows a hacker to trigger a Service-Breaking Failure (BSoD).

The vulnerability of the driver responsible for the computer’s interaction with CLFS.sys devices and devices in the Windows operating system is related to incorrect configuration data input. Exploiting this vulnerability can cause a Service-Breaking Failure BSoD through the forced invocation of t...

Smartplay Headunits 安全漏洞

Smartplay Headunits is a car player from Smartplay. A security vulnerability exists in Smartplay Headunits that stems from the presence of a misconfiguration that could lead to the disclosure of sensitive information...

WordPress Houzez Login Register Plugin <= 3.2.5 is vulnerable to Privilege Escalation

Software Houzez Login Register Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-21743 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 864db44c0749 Credits luc Required...

WordPress Houzez Theme <= 3.2.4 is vulnerable to Privilege Escalation

Software Houzez Type Theme Vulnerable versions = 3.2.4 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-22303 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 51553a618b56 Credits luc Required privilege Subscriber...

GHSA-XGQ9-7GW6-JR5R Mattermost Desktop App fails to sufficiently configure Electron Fuses

Mattermost Desktop App versions =5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access...

WordPress Maintenance Redirect Plugin <= 2.0.1 is vulnerable to Bypass Vulnerability

Software Maintenance Redirect Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.1.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-45453 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID c6be411efef1 Credits LeNgocHoa Required...

TECNO com.afmobi.boomplayer 安全漏洞

TECNO com.afmobi.boomplayer is a mobile application from TECNO China. A security vulnerability exists in TECNO com.afmobi.boomplayer, which stems from a misconfiguration of permissions, leading to account takeover...

WordPress Custom Post Limits Plugin <= 4.4.1 is vulnerable to Full Path Disclosure (FPD)

Software Custom Post Limits Type Plugin Vulnerable versions = 4.4.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6544 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 71ab81c6724d Credits stealthcopter Required...

Exploit for Code Injection in Mjml Mjml_App

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024...

GO-2024-3087 Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor

Casdoor CORS misconfiguration GHSL-2024-035 in github.com/casdoor/casdoor...

GO-2024-3088 memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

memos CORS Misconfiguration in server.go GHSL-2024-034 in github.com/usememos/memos...

Privilege Escalation

github.com/hwameistor/hwameistor is vulnerable to Privilege Escalation. The vulnerability is due to misconfiguration of the ClusterRole in Hwameistor, which allows overly broad permissions that can be abused by a malicious user...

2 TB of Sensitive “ServiceBridge” Records Exposed in Cloud Misconfiguration

A major database misconfiguration exposed millions of sensitive records belonging to ServiceBridge customers. Learn about the risks and…...

WordPress JobSearch Plugin <= 2.5.3 is vulnerable to PHP Object Injection

Software JobSearch Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A5: Security Misconfiguration Classification PHP Object Injection CVE CVE-2024-43931 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b092052f063 Credits Ananda Dhakal Patchstack...

WordPress Maintenance & Coming Soon Redirect Animation Plugin <= 2.1.3 is vulnerable to Bypass Vulnerability

Software Maintenance & Coming Soon Redirect Animation Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-43944 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 17bf0cc9007b Credits...

PT-2024-6951

Name of the Vulnerable Software and Affected Versions: Arc versions prior to 2024-08-26 Description: Arc browser, before version 2024-08-26, contains a remote code execution issue within JavaScript boosts. Normally, JavaScript boosts cannot be shared; however, misconfigured Firebase Access Contro...

Cross-Origin Resource Sharing (CORS) Bypass

github.com/usememos/memos is vulnerable to Cross-Origin Resource Sharing CORS Bypass. The vulnerability is due to a CORS misconfiguration where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true, which may allow an attacker to perform cross-origin requests,...

GHSA-P4FX-QF2H-JPMJ memos CORS Misconfiguration in server.go (GHSL-2024-034)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...

memos CORS Misconfiguration in server.go (GHSL-2024-034)

memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...