CVE-2024-35196

Sentry’s Slack integration leaks sensitive data by logging the incoming request_body, including the deprecated Slack verification token, under specific log patterns. Affected: self-hosted Sentry installations; SaaS users are unaffected. Impact in the public advisories (GHSA, Red Hat, OSV, CVE rec...

CVE-2024-1275

CVE-2024-1275 affects Baxter Welch Allyn Connex Spot Monitor (CSM) prior to version 1.52. The vulnerability stems from a default cryptographic key, enabling an attacker to modify device configuration and firmware data, with potential impact on patient care. The ICS advisory notes remote exploitat...

CVE-2024-36120

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the...

CVE-2024-35142

In the available documents, CVE-2024-35142 affects IBM Security Verify Access Docker versions 10.0.0 and 10.0.6. The root cause is execution of unnecessary privileges that allows a local user to escalate privileges, yielding a HIGH impact (confidentiality, integrity, and availability). IBM’s bull...

CVE-2024-35140

CVE-2024-35140 affects IBM Security Verify Access Docker versions 10.0.0–10.0.6. The root cause is improper certificate validation that could allow a local user to escalate privileges. The IBM PSIRT and related advisories indicate a fix released with 10.0.7 (and ISVA 10.0.7-ISS-ISVA-FP0000 for 10...

CVE-2024-36120

CVE-2024-36120 concerns the javascript-deobfuscator library. Affected versions allow crafted payloads that target the expression simplification feature to cause code execution. The issue is mitigated by updating to version 1.1.0; if upgrading is not possible, users should disable the expression s...

CVE-2022-25037

An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...

CVE-2022-25038

wanEditor v4.7.11 was discovered to contain a cross-site scripting XSS vulnerability via the video upload function...

CVE-2022-25037

The CVE-2022-25037 entry concerns wanEditor. A cross-site scripting (XSS) vulnerability exists in wanEditor version 4.7.11 exposed via the image upload function. The issue is fixed in version 4.7.12 and in version 5.0.0 (listed as v.5). Impact details in the provided sources indicate an XSS flaw ...

CVE-2022-25038

CVE-2022-25038 concerns wanEditor up to version 4.7.11, where a cross-site scripting (XSS) vulnerability is triggered via the video upload function. The CVSS 3.1 base score is 6.1 (MEDIUM) with network attack, low attack complexity, and user interaction required. Affected component: wanEditor vid...

CVE-2024-28736

The CVE-2024-28736 entry concerns Debezium Community debezium-ui v2.5. The connected documents provide concrete details: a local attacker can execute arbitrary code through the application’s refresh page function, indicating a local-privilege/execution path with low privileges required and no use...

CVE-2024-1980

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-6876. Reason: This candidate is a reservation duplicate of CVE-2023-6876. Notes: All CVE users should reference CVE-2023-6876 instead of this candidate. All references and descriptions in this candidate have been remov...

CVE-2024-36108

Summary: CVE-2024-36108 affects casgate, an open source identity and access management system. Affected: casgate versions with a broken function-level authorization vulnerability that allows remote, unauthenticated attackers to read sensitive information via GET requests to an API endpoint by man...

CVE-2023-7073

The CVE-2023-7073 entry concerns the WordPress plugin Auto Featured Image (Auto Post Thumbnail) prior to or including version 4.0.0. It is exposed to Server-Side Request Forgery via the upload_to_library AJAX action, enabling authenticated attackers with author-level access and above to trigger w...

CVE-2024-5565

CVE-2024-5565 concerns the Vanna.AI library (Python) where prompt injection in the library’s ask API, with visualize set to True, can execute arbitrary Python code on the host, enabling remote code execution. The vulnerability arises from insufficient input validation in the prompt generation tha...

CVE-2024-31907

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 289889...

CVE-2024-31908

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2024-31907

CVE-2024-31907 affects IBM Planning Analytics Local (Workspace) Web UI in versions 2.0 and 2.1, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The root cause is a cross-site scripting vulnerability in the Web UI. The impact descri...

CVE-2024-31908

Summary: CVE-2024-31908 affects IBM Planning Analytics Local (IBM Planning Analytics Workspace) versions 2.0 and 2.1 with a stored cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Detail...

CVE-2024-31889

CVE-2024-31889 affects IBM Planning Analytics Local (IBM Planning Analytics Workspace) versions 2.0 and 2.1. The vulnerability is a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a...