CVE-2024-36378

In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens...

CVE-2024-36470

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases...

CVE-2024-36373

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible...

CVE-2024-36366

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations...

CVE-2024-36368

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible...

CVE-2024-36364

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible...

CVE-2024-36368

CVE-2024-36368 affects JetBrains TeamCity prior to version 2022.04.7, 2022.10.6, 2023.05.6, and 2023.11.5. The issue is a cross-site scripting (XSS) vulnerability that arises from insufficient protection of the OAuth provider configuration, allowing a crafted payload to be reflected via that conf...

CVE-2024-25976

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the...

CVE-2024-5039

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-5185

CVE-2024-5185 concerns the EmbedAI application, where a CSRF weakness resulting from the absence of secure session management and weak CORS policies enables data poisoning. An attacker can lure a user to a malicious page that triggers the CSRF flaw, causing the user to upload and integrate incorr...

CVE-2023-42005

CVE-2023-42005 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (versions 3.5 through 4.8 with various refresh levels). The issue allows a user with access to a Kubernetes pod to make system calls, compromising container security. IBM’s remediation is to upgrade to th...

CVE-2024-3412

CVE-2024-3412 affects the WP STAGING WordPress Backup Plugin – Migration Backup Restore. It is vulnerable in versions

CVE-2024-36015

In CVE-2024-36015, the Linux kernel exposes a flaw in ppdev: register_device does not validate the index returned by ida_simple_get, risking use of an invalid index. The fix is to check the index after ida_simple_get, and if abnormal, print a warning, drop the port, and record the value. Public a...

CVE-2024-3937

The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-36014

CVE-2024-36014 affects the Linux kernel DRM Mali DP path (drm/arm/malidp). In malidp_mw_connector_reset, memory is allocated with kzalloc but the NULL return is not checked, risking a null pointer dereference when calling __drm_atomic_helper_connector_reset. The issue is addressed in the referenc...

CVE-2024-3921

CVE-2024-3921 (Gianism) affects Gianism WordPress plugin up to version 5.1.0. It enables Admin+ Stored XSS due to insufficient sanitisation/escaping of certain settings, potentially allowing admin users to execute scripts even when unfiltered_html is disallowed. The Patchstack entry notes a fix i...

CVE-2024-3937

The CVE-2024-3937 entry concerns the Playlist for Youtube WordPress plugin (versions = 1.40. The base CVSS in the initial document is MEDIUM (4.8). No exploitation status is stated in the provided materials; remediation guidance is to update to a patched version and follow vendor advisories.

CVE-2024-3050

The CVE-2024-3050 entry concerns the WordPress plugin Site Reviews. Public records show the plugin before version 7.0.0 retrieves client IP addresses from untrusted headers, allowing an attacker to manipulate the value and potentially bypass IP-based blocking. Red Hat’s advisory and Patchstack de...

CVE-2024-4419

CVE-2024-4419 – Fetch JFT (WordPress) stored XSS in all versions up to 1.8.3. Root cause: insufficient input sanitization and output escaping in admin/settings, enabling authenticated attackers with administrator-level permissions to inject scripts that run when users view injected pages. Affecte...

CVE-2024-21512

The CVE (CVE-2024-21512) affects the mysql2 package prior to version 3.9.8. The vulnerability is a Prototype Pollution issue caused by improper user input sanitization when using nestTables, allowing an attacker to manipulate the prototype of objects. Public sources in connected documents corrobo...