5470 matches found
Privilege Escalation
github.com/hwameistor/hwameistor is vulnerable to Privilege Escalation. The vulnerability is due to misconfiguration of the ClusterRole in Hwameistor, which allows overly broad permissions that can be abused by a malicious user...
2 TB of Sensitive “ServiceBridge” Records Exposed in Cloud Misconfiguration
A major database misconfiguration exposed millions of sensitive records belonging to ServiceBridge customers. Learn about the risks and…...
WordPress JobSearch Plugin <= 2.5.3 is vulnerable to PHP Object Injection
Software JobSearch Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A5: Security Misconfiguration Classification PHP Object Injection CVE CVE-2024-43931 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b092052f063 Credits Ananda Dhakal Patchstack...
WordPress Maintenance & Coming Soon Redirect Animation Plugin <= 2.1.3 is vulnerable to Bypass Vulnerability
Software Maintenance & Coming Soon Redirect Animation Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-43944 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 17bf0cc9007b Credits...
PT-2024-6951
Name of the Vulnerable Software and Affected Versions: Arc versions prior to 2024-08-26 Description: Arc browser, before version 2024-08-26, contains a remote code execution issue within JavaScript boosts. Normally, JavaScript boosts cannot be shared; however, misconfigured Firebase Access Contro...
Cross-Origin Resource Sharing (CORS) Bypass
github.com/usememos/memos is vulnerable to Cross-Origin Resource Sharing CORS Bypass. The vulnerability is due to a CORS misconfiguration where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true, which may allow an attacker to perform cross-origin requests,...
GHSA-P4FX-QF2H-JPMJ memos CORS Misconfiguration in server.go (GHSL-2024-034)
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...
memos CORS Misconfiguration in server.go (GHSL-2024-034)
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...
Casdoor CORS misconfiguration (GHSL-2024-035)
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...
GHSA-MCHX-7J67-8MCF Casdoor CORS misconfiguration (GHSL-2024-035)
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...
ALBeast: Misconfiguration Flaw Exposes 15,000 AWS Load Balancers to Risk
ALBeast is a critical vulnerability that allows attackers to bypass authentication and authorization in AWS ALB-based applications. Learn…...
CVE-2024-43878
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...
UBUNTU-CVE-2024-43878
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...
CVE-2024-43878 xfrm: Fix input error path memory access
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix input error path memory access When there is a misconfiguration of input state slow path KASAN report error. Fix this error. west login: 52.987278 eth1: renamed from veth11 53.078814 eth1: renamed from veth21 53.181355...
GO-2023-1985 Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes
Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes...
CVE-2024-41659
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...
CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...
CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...
CVE-2024-41659
The CVE-2024-41659 issue affects memos (server.go) where a CORS misconfiguration in version
CVE-2024-41659 GHSL-2024-034: memos CORS Misconfiguration in server.go
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker...