PT-2024-27383 · Unknown · Transition Slider

Name of the Vulnerable Software and Affected Versions: Transition Slider – Responsive Image Slider and Gallery versions n/a through 2.20.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stor...

vulnerability-research

vulnerability-...

Exploit for CVE-2020-13945

CVE-2020-13945 - Apache APISIX Remote Code Execution RCE Th...

CVE-2024-5255

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimatedualcolor shortcode in all versions up to, and including, 3.19.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-26439 · Tenda · Tenda I29

Name of the Vulnerable Software and Affected Versions: Tenda i29V1.0 version 1.0.0.5 Description: The issue is related to a hardcoded password for the root user. This means that the password is embedded directly into the software, potentially allowing unauthorized access. Recommendations: For Ten...

Django 4.x < 4.2.14, 5.x < 5.0.7 Multiple Vulnerabilities - Linux

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

MAL-2024-7702 Malicious code in cloudhost (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06d8e1813e9e9ae1dd5749ee815f32696a16d538138675ee92e5cd2272e6c870 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-34723

In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2024-31334

In DevmemIntFreeDefBackingPage of devicememserver.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-31334

In DevmemIntFreeDefBackingPage of devicememserver.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

PT-2024-4759

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint versions prior to the fixed version Description: The vulnerability in Microsoft SharePoint is related to deserialization and allows remote attackers to execute arbitrary code. This issue has been exploited in real-world...

PT-2024-28626 · Fedify · Fedify

Name of the Vulnerable Software and Affected Versions: Fedify versions prior to 0.9.2, 0.10.1, or 0.11.1 Description: The issue is related to a Server Side Request Forgery attack. When Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the...

MAL-2024-7407 Malicious code in @zitterorg/vitae-non (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d396ac39fe415b823f8b908a69652a99cf9bc80b5f035f6c2a844a8d8686b328 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387 Nuclei Template Nuclei template to d...

CVE-2024-20080

In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08720039; Issue ID: MSV-1424...

ASB-A-331437482

In UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

[SECURITY] [DLA 3848-1] org-mode security update

Debian LTS Advisory DLA-3848-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton June 29, 2024 https://wiki.debian.org/LTS Package : org-mode Version : org-mode 9.1.14+dfsg-3+deb10u3 CVE ID : CVE-2024-39331 Debian Bug : 1074136 A vulnerability was discovered in Org-mod...

Malicious code in Mail (NuGet)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-4400 · Pgadmin · Pgadmin

Name of the Vulnerable Software and Affected Versions: pgAdmin versions prior to 8.8 pgAdmin 4 affected versions not specified Description: The issue is related to errors in permission handling, which can allow an attacker to gain unauthorized access to the installation directory on certain...