CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

CVE-2024-29402

cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity...

PT-2024-22883 · Cskefu · Cskefu

Name of the Vulnerable Software and Affected Versions: cskefu version 7 Description: The issue is related to Insufficient Session Expiration, which allows attackers to exploit old sessions for malicious activity. Recommendations: For cskefu version 7, consider implementing proper session expirati...

CVE-2024-29402

cskefu v7 is vulnerable to Insufficient Session Expiration (CWE-613), which allows attackers to exploit old sessions for malicious activity. As a temporary workaround, it is recommended to restrict access to sensitive areas of the application that rely on session-based authentication until a prop...

CVE-2024-1741

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by...

CVE-2024-1741

CVE-2024-1741 affects lunary-ai/lunary v1.0.1, with an improper authorization flaw enabling removed members to read, create, modify, and delete prompt templates by reusing an old authorization token. The issue allows operations on prompt templates despite removal from an organization, via HTTP re...

lunary 授权问题漏洞

Lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary version 1.0.1 that stems from allowing deleted members to read, create, modify, and delete prompt templates using an old authorization token. An attacker can exploit this vulnerabilit...

PT-2024-18266 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.0.1 Description: The issue allows removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform...

PT-2024-18409 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary affected versions not specified Description: The issue allows a removed user to change the organization name without proper authorization due to the lack of validation to check if a user is still part of an organization befor...

AZL-59267 CVE-2024-26811 affecting package kernel for versions less than 6.6.82.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid...

quic-go 安全漏洞

quic-go is an implementation of the QUIC protocol, RFC 9000 protocol, in Go by the individual developer Lucas Clemente. A security vulnerability exists in versions of quic-go prior to 0.42.0. An attacker exploiting this vulnerability could send a large number of NEWCONNECTIONID frames to obsolete...

OpenHarmony 安全漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony prior to version v3.2.4. A remote attacker could exploit the vulnerability to bypass privilege authentication to insta...

util-linux 安全漏洞

util-linux is an open source software package. A security vulnerability exists in util-linux version 2.40 and earlier, which stems from the fact that wall is typically installed with the setgid tty permission, which allows escape sequences to be sent to other users' terminals via argv, which coul...

PT-2024-3307 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S10 Junos OS versions 21.2 through 21.2R3-S7 Junos OS versions 21.3 through 21.3R2 Junos OS versions 21.4 through 21.4R2 Junos OS versions 22.1 through 22.1R1 Junos OS Evolved versions prior to 21.2R3-S8-EVO...

CVE-2024-1844: Missing Authorization

The RevivePress – Keep your Old Content Evergreen plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the importdata and copydata functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated...

PT-2024-20749 · Unknown · Maspik – Spam Blacklist

Name of the Vulnerable Software and Affected Versions: Maspik – Spam Blacklist versions 0.10.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

jose Security Vulnerabilities

jose is a JavaScript module for signing and encrypting JSON objects. A security vulnerability exists in jose versions prior to 4.0.1, 3.0.3, and 2.6.3, which allows an attacker to send JWEs containing compressed data that uses a large amount of memory and CPU when decompressed via Decrypt or...

FreeBSD : Gitlab -- Vulnerabilities (b2caae55-dc38-11ee-96dc-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b2caae55-dc38-11ee-96dc-001b217b3468 advisory. - An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior...