59811 matches found
PT-2024-39240 · Axis · Axis Os
Name of the Vulnerable Software and Affected Versions: AXIS OS versions prior to the patched version Description: The VAPIX API managedoverlayimages.cgi is vulnerable to a race condition attack, allowing an attacker to block access to the overlay configuration page in the web interface of the Axi...
PT-2024-35970
Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...
GHSA-93WW-43RR-79V3 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, keycloak...
GHSA-93WW-43RR-79V3 vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-config-cli...
CVE-2024-10039 vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-config-cli...
CVE-2024-10039 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, keycloak...
CVE-2024-9851
The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...
AZL-53622 CVE-2024-30896 affecting package influxdb 2.6.1-30
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
AZL-53438 CVE-2024-30896 affecting package influxdb 2.7.5-19
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
UBUNTU-CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
CVE-2024-9851
CVE-2024-9851: LSX Tour Operator WordPress plugin
WordPress plugin LSX Tour Operator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
November 21, 2024—KB5046714 (OS Build 19045.5198) Preview
None None...
CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
Access Control Bypass
Overview influxdb-client is an InfluxDB 2.0 Python client library Affected versions of this package are vulnerable to Access Control Bypass due to a business logic flaw that allows users who own a valid allAccess token to escalate their privileges at operator level by listing current authorizatio...
WordPress LSX Tour Operator plugin <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin LSX Tour Operator versions = 1.4.9...
AI Granny Daisy takes up scammers’ time so they can’t bother you
A mobile network operator has called in the help of Artificial Intelligence AI in the battle against phone scammers. Virgin Media O2 in the UK has built an AI persona called Daisy with the sole purpose of keeping scammers occupied for as long as possible. Basically, until the scammers give up,...
WordPress LSX Tour Operator Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)
Software LSX Tour Operator Type Plugin Vulnerable versions = 1.4.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9851 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff9d84e2d494 Credits Francesco Carlucci...
Security Bulletin: Security vulnerability CVE-2024-39689 in Certifi python-certifi that is used by FileNet Content Manager and CP4BA - Filenet Content Manager Component
Summary Security vulnerability CVE-2024-39689 in Certifi python-certifi that is used by FileNet Content Manager and CP4BA - Filenet Content Manager Component in container Operator Vulnerability Details CVEID:CVE-2024-39689 DESCRIPTION: Certifi python-certifi could provide weaker than expected...