CVE-2024-10490

The CVE-2024-10490 issue affects B&R mapp Cockpit, View, Services, Motion, and Vision prior to version 6.0, due to an Authentication Bypass in the OPC UA Server configuration. The root cause is an authentication bypass that can be triggered by an unauthenticated network-based attacker, potentiall...

PT-2024-16313 · B&R · B&R Mapp Vision +5

Name of the Vulnerable Software and Affected Versions: B&R mapp Cockpit versions prior to 6.0 B&R mapp View versions prior to 6.0 B&R mapp Services versions prior to 6.0 B&R mapp Motion versions prior to 6.0 B&R mapp Vision versions prior to 6.0 Description: An "Authentication Bypass Using an...

CVE-2024-52420

Cross-Site Request Forgery CSRF vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through = 1.4.0...

CVE-2024-52420

CVE-2024-52420 concerns a Cross-Site Request Forgery in the WordPress plugin Disable Admin Notices individually. The initial record specifies that the issue affects plugin versions up to 1.3.5, and multiple connected sources corroborate a CSRF vulnerability in this plugin. Patchstack and related ...

tsMuxer 安全漏洞

tsMuxer is a transport stream multiplexer for remixing/multiplexing elementary streams by Dan's personal developer. A security vulnerability exists in version tsMuxer nightly-2024-05-12-02-01-18, which stems from the presence of a buffer overflow that allows an attacker to cause a denial of servi...

CVE-2024-38719

CVE-2024-38719 is a real, publicly documented vulnerability affecting the WordPress plugin Creative Motion Auto Featured Image (Auto Post Thumbnail) up to version 4.1.2 . The root cause is a Missing/Incorrectly Configured Authorization that allows exploitation of access control weaknesses in the ...

CVE-2024-43122 WordPress Robin image optimizer plugin <= 1.6.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9...

CVE-2024-43122

CVE-2024-43122 describes a Missing Authorization (Broken/Incorrect Access Control) vulnerability in the Robin image optimizer WordPress plugin, affecting version 1.6.9 and earlier. The CVE notes that exploitation requires Network access with Low attack complexity and Low privileges, with potentia...

CVE-2024-43260

CVE-2024-43260 refers to a Missing Authorization vulnerability in the WordPress plugin Clearfy Cache. Public sources indicate affected versions up to 2.2.4 and describe an incorrectly configured access control that could enable unauthorized access. The provided connected documents do not specify ...

PT-2024-28164 · Creative Motion · Creative Motion Auto Featured Image

Name of the Vulnerable Software and Affected Versions: Creative Motion Auto Featured Image Auto Post Thumbnail versions 4.1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels...

PT-2024-28213 · Creative Motion · Creativemotion Titan Anti-Spam & Security

Name of the Vulnerable Software and Affected Versions: CreativeMotion Titan Anti-spam & Security versions n/a through 7.3.6 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: F...

PT-2024-30310 · Unknown · Creative Motion Robin

Name of the Vulnerable Software and Affected Versions: Creative Motion Robin image optimizer versions 1.6.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

Motion Spell GPAC Null Pointer Dereference Vulnerability

Motion Spell GPAC contains a null pointer dereference vulnerability that could allow a local attacker to cause a denial-of-service DoS condition...

The vulnerability of the `mc_chroma` function in the `motion.cc` component of the h.265 Libde265 video codec implementation, related to writing beyond buffer boundaries, allows a hacker to cause a service failure.

The vulnerability of the mcchroma function in the motion.cc component of the H.265 Libde265 video codec implementation is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to cause service failures using a specially created video file...

OSV-2024-925 Index-out-of-bounds in derive_collocated_motion_vectors

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537038 Crash type: Index-out-of-bounds Crash state: derivecollocatedmotionvectors derivetemporallumavectorprediction getmergecandidatelistwithoutstep9...

CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service under construction, XTTS service, Petals service, vLLM service, and Motion Ctrl service,...

CVE-2024-4839

CVE-2024-4839 affects parisneo/lollms-webui, versions 9.6 through the latest. The vulnerability is a CSRF flaw in the 'Servers Configurations' function that guards several components (Elastic search Service, XTTS service, Petals service, vLLM service, Motion Ctrl service). The root cause is lack ...

CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service under construction, XTTS service, Petals service, vLLM service, and Motion Ctrl service,...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version 9.6 and prior versions, which stems from a lack of cross-site request forgery protection in the Elastic Search Service, XTTS...

CVE-2024-5263

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...