Fedora 39 : xrdp (2024-41c1bf8de6)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-41c1bf8de6 advisory. Release notes for xrdp v0.10.1 2024/07/31 General announcements A clipboard bugfix included in this release is sponsored by Krmer Pferdesport GmbH & Co KG. W...

DEBIAN-CVE-2024-42232

In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayedwork and cephmoncstop The way the delayed work is handled in cephmoncstop is prone to races with monfault and possibly also finishhunting. Both of these can requeue the delayed work which wouldn't...

Microsoft Azure Availability Monitor for Kafka esnewdeveastdockerregistry Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Availability Monitor for Kafka for Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of Availability Monitor for Kafka...

CVE-2024-5678

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature...

CVE-2024-5678

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature...

CVE-2024-5678 SQL Injection

Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the Create Monitor feature...

PT-2024-37071

Name of the Vulnerable Software and Affected Versions Zohocorp ManageEngine Applications Manager versions 17.0900 and below Description The issue concerns an authenticated admin-only SQL Injection in the Create Monitor feature. Recommendations For versions 17.0900 and below, update to a version...

Plug and Track Thermoscan IP 安全漏洞

Plug and Track Thermoscan IP is a simple device from the French company Plug and Track. It is used to monitor the temperature and humidity of refrigerators, freezers, incubators, and other devices. A security vulnerability exists in Plug and Track Thermoscan IP that stems from assigning incorrect...

Tenable Nessus Network Monitor < 6.4.0 Multiple Vulnerabilities (TNS-2024-07)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Alecto IVM-100 安全漏洞

Alecto IVM-100 is a baby monitor with camera from Alecto. Alecto IVM-100 has a security vulnerability that stems from a lack of authentication...

USN-6926-1 linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities

黄思聪 discovered that the NFC Controller Interface NCI implementation in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash...

WordPress Campaign Monitor for WordPress plugin <= 2.8.15 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Campaign Monitor for WordPress versions = 2.8.15...

WordPress Campaign Monitor for WordPress Plugin <= 2.8.15 is vulnerable to Sensitive Data Exposure

Software Campaign Monitor for WordPress Type Plugin Vulnerable versions = 2.8.15 Fixed in 2.8.16 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6569 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 63abfd042be5 Credits...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that reading the scheduling trace logs of /sys/kernel/debug/powerpc/dtl/cpu- when...

CVE-2024-6569 Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure

The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and displayerrors being enabled. This makes it possible for...

CVE-2024-6569

CVE-2024-6569 concerns the Campaign Monitor for WordPress plugin. Affected versions: all up to and including 2.8.15. Root cause: the plugin does not restrict direct access to /forms/views/admin/create.php and display_errors is enabled, enabling unauthenticated users to retrieve the full path of t...

CVE-2024-6569 Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure

The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and displayerrors being enabled. This makes it possible for...

WordPress plugin Campaign Monitor for WordPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Malicious code in netsec-monitor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d53ca1631ad5169910977a710485caa2e85f057cba20a5d29bdcaeccda0cf4f9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2024-4447

In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...