CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

Gnuboard 安全漏洞

Gnuboard is a suite of extensible forum programs from the Gnuboard open source. A security vulnerability exists in Gnuboard g6 version 6.0.7, which stems from a CORS misconfiguration that makes it vulnerable to session hijacking...

CVE-2024-41475

Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, related to incorrect session expiration times, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to incorrect session duration settings. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

WordPress Shared Files Plugin <= 1.7.28 is vulnerable to Sensitive Data Exposure

Software Shared Files Type Plugin Vulnerable versions = 1.7.28 Fixed in 1.7.29 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-43230 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID 9e141e472eac Credits Abdi Pranata Required privile...

WordPress Easy PayPal Buy Now Button Plugin <= 1.9 is vulnerable to Open Redirection

Software Easy PayPal Buy Now Button Type Plugin Vulnerable versions = 1.9 Fixed in 1.9.1 OWASP Top 10 A6: Security Misconfiguration Classification Open Redirection CVE CVE-2024-43236 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 1373cfd80ec3 Credits stealthcopter Require...

Flowise Cors Misconfiguration in packages/server/src/index.ts

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...

GHSA-66F2-XXGM-F6XP Flowise Cors Misconfiguration in packages/server/src/index.ts

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery

WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRONRUNASNODE' environment variable. Any malicious application operating with standard user permissions can exploit this vulnerability,...

CVE-2024-22169

CVE-2024-22169 affects WD Discovery. Versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could enable code execution by abusing the ELECTRON_RUN_AS_NODE environment variable. The attack requires the victim to have the WD Discovery app installed; exploitat...

CVE-2024-31201

A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIPScrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine...

CVE-2024-31201

A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIPScrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine...

CVE-2024-31201

CVE-2024-31201 affects the ThermoscanIP Scrutation service. The root cause is a CWE-428 Unquoted Search Path or Element, which can be abused when the C:\ path permissions are misconfigured, potentially enabling local privilege escalation. Exploitation details are not provided in the documents. Re...

PT-2024-23845 · Unknown · Thermoscanip Scrutation

Name of the Vulnerable Software and Affected Versions: ThermoscanIP Scrutation affected versions not specified Description: A misconfiguration known as "CWE-428: Unquoted Search Path or Element" affects the ThermoscanIP Scrutation service. This issue could be exploited in scenarios where incorrec...

Proofpoint Email Routing Flaw Exploited to Send Millions of Spoofed Phishing Emails

An unknown threat actor has been linked to a massive scam campaign that exploited an email routing misconfiguration in email security vendor Proofpoint's defenses to send millions of messages spoofing various popular companies like Best Buy, IBM, Nike, and Walt Disney, among others. "These emails...

Linux kernel 安全漏洞

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that originates from a memory corruption due to an incorrectly specified port number on a Spectrum-4 system when using the Shared Buffer Status Registe...

CVE-2024-37380

A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: UniFi U6+ Access Point Version 6.6.65 and earlier Mitigation: Update your UniFi U6+ Access Point to Version 6.6.74 or later...

CVE-2024-37380

A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: UniFi U6+ Access Point Version 6.6.65 and earlier Mitigation: Update your UniFi U6+ Access Point to Version 6.6.74 or later...

CVE-2024-37380

A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. Affected Products: UniFi U6+ Access Point Version 6.6.65 and earlier Mitigation: Update your UniFi U6+ Access Point to Version 6.6.74 or later...