CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

Malicious code in 52qr42 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e559619ab6112e5213407ad80e432cfb2f9143718e79a18bf5c4f94d26ecf0d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Critical Patch Update Advisory - October 2024

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...

PT-2024-38029

Name of the Vulnerable Software and Affected Versions Sharp NEC Projectors NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525WLG, NP-P525WLJL, NP-CG6500UL, NP-CG6500WL, NP-CG6700UL, NP-P605UL, NP-P605UL+, NP-P605ULG, NP-P605ULJL,...

The vulnerability of the `fromSafeSetMacFilter` function in the `/goform/setMacFilterList` microprogramming system of the Tenda wireless access point allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the fromSafeSetMacFilter function in the /goform/setMacFilterList microprogramming system for the wireless access point Tenda is related to the operation of the function beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary co...

CVE-2024-9030

A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/noteid/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2024-9030: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in CodeCanyon CRMGo SaaS 7.2. This vulnerability affects unknown code of the file /deal/noteid/note. The manipulation of the argument notes leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to th...

PT-2024-39374

Name of the Vulnerable Software and Affected Versions: CodeCanyon CRMGo SaaS version 7.2 Description: A problematic vulnerability was found in CodeCanyon CRMGo SaaS, affecting the file "/deal/note id/note". The manipulation of the notes argument leads to cross-site scripting. The attack can be...

BELL-CVE-2024-46718

Bulletin has no description...

CVE-2024-0067

creationtimestamp| type| source ---|---|--- 2024-09-10 07:32:33+00:00| seen| https://t.me/cvedetector/5173...

CVE-2024-40643

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag...

CVE-2024-40643 Joplin has a parsing error leading to Cross-site Scripting (XSS)

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag...

CVE-2024-40643

Summary: CVE-2024-40643 affects Joplin via a parsing error that fails to properly handle “

UBUNTU-CVE-2024-44993

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix out-of-bounds read in v3dcsdjobrun When enabling UBSAN on Raspberry Pi 5, we get the following warning: 387.894977 UBSAN: array-index-out-of-bounds in drivers/gpu/drm/v3d/v3dsched.c:320:3 387.903868 index 7 is out of...

CVE-2024-45308 MySQL & free URL mode allows to hide existing notes in hedgedoc

HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by t...

CVE-2024-45308

HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existing notes. The affected existing note can then not be accessed anymore and is effectively hidden by t...

CVE-2024-45308

HedgeDoc (the HedgeDoc project) contains a vulnerability affecting deployments using MySQL or MariaDB where an alias can be created equal to the ID of an existing note. The new note’s alias hides the original note and, in freeURL mode, can be created by users with appropriate permissions or, depe...

PT-2024-31561 · Oracle +1 · Mysql Server +1

Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.10.0 Description: HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc with MySQL or MariaDB, it is possible to create notes with an alias matching the ID of existi...

New Qilin Ransomware Attack Uses VPN Credentials, Steals Chrome Data

The threat actors behind a recently observed Qilin ransomware attack have stolen credentials stored in Google Chrome browsers on a small set of compromised endpoints. The use of credential harvesting in connection with a ransomware infection marks an unusual twist, and one that could have cascadi...

YznCMS 安全漏洞

YznCMS is a backend development framework. A cross-site scripting vulnerability exists in YznCMS version 1.4.2, which stems from the lack of effective filtering and escaping of user-supplied data in the component /index/index.html, and can be exploited by an attacker to execute arbitrary Web scri...