LinkAce 安全漏洞

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Personal Developer. A security vulnerability exists in LinkAce versions prior to 1.15.6. An attacker exploiting this vulnerability could upload a malicious HTML file containing a JavaScript payload...

Malicious code in old-celo-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1842e08f1ce198d27488ce0f57a12762160650f8c130e49d19053af3f86147 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12116 Malicious code in old-celo-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1842e08f1ce198d27488ce0f57a12762160650f8c130e49d19053af3f86147 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in old-package-name (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11410 Malicious code in old-package-name (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-12151

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets...

Cisco Urges Immediate Patch for Decade-Old WebVPN Vulnerability

The vulnerability was first identified in 2014...

Devolutions Server 产品安全漏洞

Devolutions Server is an application from Devolutions Canada Inc. which provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2024.3.8.0 and prior versions, which stems from an incorrect assignment of privileges in...

PT-2024-28393 · Aginode · Aginode Gigaswitch V5

Name of the Vulnerable Software and Affected Versions: Aginode GigaSwitch V5 versions prior to 7.06G Description: The issue allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities. This can be do...

AZL-54595 CVE-2024-53099 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link-type in bpflinkshowfdinfo If a newly-added link type doesn't invoke BPFLINKTYPE, accessing bpflinktypestrslink-type may result in an out-of-bounds access. To spot such missed invocations early in the...

WordPress WooCommerce Price Alert plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WooCommerce Price Alert versions = 1.0.4...

ZhongBangKeJi CRMEB 安全漏洞

ZhongBangKeJi CRMEB is an open source e-commerce management system from ZhongBangKeJi China. A security vulnerability exists in ZhongBangKeJi CRMEB version 5.4.0 and earlier versions, which stems from an access control error...

Chatwoot 授权问题漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. An authorization issue vulnerability exists in versions prior to Chatwoot 2.4.0 that stems from the presence of a session fixation...

PT-2024-34830 · Ciprian Popescu · W3P Seo

Name of the Vulnerable Software and Affected Versions: W3P SEO versions prior to 1.8.6 Description: A Cross-Site Request Forgery CSRF issue is present in Ciprian Popescu W3P SEO, leading to Stored Cross Site Scripting XSS. Recommendations: For versions prior to 1.8.6, update to version 1.8.6 or...

PT-2024-38244 · Telerik · Telerik Report Server

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Report Server versions prior to 2024 Q4 10.3.24.1112 Description: The encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information. Recommendations: For versions...

CVE-2024-9835

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2024-9835 RSS Feed Widget < 3.0.1 - Reflected XSS

The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

kernel: ibmvnic: Add tx check to prevent skb leak

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: txbufffreemapconsumerindex-skb = newskb; freemapconsumerindex = IBMVNICINVALIDMAP; consumerindex ++; Whe...

CVE-2024-10765

A vulnerability classified as critical was found in Codezips Online Institute Management System up to 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument oldimage leads to unrestricted upload. The attack can be initiated remotely. The exploit ha...

Codezips Online Institute Management System 安全漏洞

Codezips Online Institute Management System is an open source online institute management system from Codezips. A security vulnerability exists in Codezips Online Institute Management System version 1.0, which stems from mishandling of the parameter oldimage, resulting in unrestricted uploads...