CVE-2024-54485: Insecure Storage of Sensitive Information

The issue was addressed by adding additional logic. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2. An attacker with physical access to an iOS device may be able to view notification content from the lock screen...

UBUNTU-CVE-2024-47761

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

GHSA-VJMW-J32J-PH4F

creationtimestamp| type| source ---|---|--- 2024-12-11 17:10:00+00:00| seen| https://infosec.exchange/users/cve/statuses/113635295264729068...

CVE-2024-47761 GLPI vulnerable to account takeover via the password reset feature

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an administrator with access to the sent notifications contents can take control of an account with higher privileges. Version 10.0.17 contains a patch for this issue...

PT-2024-36352 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: iPadOS versions prior to 17.7.3 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue allows an attacker with physical access to an iOS device to view notification content from the lock screen. This is possible due t...

[SECURITY] Fedora 40 Update: zabbix-6.0.36-1.fc40

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

WordPress Simple Notification plugin <= 1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Simple Notification versions = 1.3...

WordPress Elite Notification plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Elite Notification versions = 1.5...

GHSA-JCXM-7WVP-G6P5 Modified package published to npm, containing malware that exfiltrates private key material

Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from...

CVE-2024-43077

creationtimestamp| type| source ---|---|--- 2024-12-04 06:05:42+00:00| seen| https://t.me/itsecnews/4888 2025-01-03 00:19:19+00:00| seen| https://infosec.exchange/users/cve/statuses/113761554223801442 2025-01-03 01:15:32+00:00| seen|...

CVE-2024-11479 Authenticated HTML Injection in Issuetrak Ticket Comment Function

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket...

PT-2024-10669 · Google · Android +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible stack buffer overflow in the MTK FLP MSG HAL DIAG REPORT DATA NTF handler of flp2hal interface.c due to a missing...

CVE-2018-9413

In handlenotificationresponse of btifrc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2024-10677 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to a possible out of bounds write in the handle notification response function of btif rc.cc due to a missing bounds check. This could lead to remote code execution...

PT-2024-35609

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue concerns the Linux kernel's network scheduling subsystem, specifically the qdisc tree reduce backlog function. Changes to sch-q.qlen around this function need to occur before the...

GHSA-4CHJ-3C28-GVMP

creationtimestamp| type| source ---|---|--- 2024-11-29 18:29:08+00:00| seen| https://infosec.exchange/users/cve/statuses/113567658636613264...

GHSA-XG58-75QF-9R67

creationtimestamp| type| source ---|---|--- 2024-11-25 18:50:12+00:00| seen| https://infosec.exchange/users/cve/statuses/113545092265515508...

Astra Linux – Vulnerability in Firefox

Selected options might obscure the full-screen notification dialog box. This could be exploited by a malicious site to carry out a spoofing attack. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

November 21, 2024—KB5046732 (OS Builds 22621.4541 and 22631.4541) Preview

None None...

WordPress WordPress Announcement & Notification Banner Plugin – Bulletin Plugin <= 3.11.7 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Announcement & Notification Banner Plugin – Bulletin Type Plugin Vulnerable versions = 3.11.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10682 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownersh...