CVE-2024-25046

CVE-2024-25046 affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Authenticated user can trigger a denial of service via a specially crafted query against Db2 components (versions 3.5 through latest refresh). The issue has a remediation path: upgrade to the latest Cloud...

CVE-2024-25030

CVE-2024-25030 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (v3.5–refresh 10, v4.0–refresh 9, v4.5–refresh 3, v4.6–refresh 6, v4.7–refresh 4, v4.8–refresh 4). The issue is that 11.1 releases store potentially sensitive information in log files readable by a local ...

CVE-2024-25918

CVE-2024-25918 affects the WordPress plugin InstaWP Connect (InstaWP) Suite. The vulnerability is described as Unrestricted Upload of File with Dangerous Type, enabling remote code execution (RCE). Affected versions: InstaWP Connect from n/a through 0.1.0.8. Public writeups/reports in connected d...

CVE-2024-27191

CVE-2024-27191 concerns the WordPress plugin Slivery Extender (Inpersttion Slivery Extender). Public sources describe an "ImpropER Control of Generation of Code (Code Injection)" vulnerability that enables an authenticated attacker (Contributor+) to execute arbitrary code via the plugin’s shortco...

CVE-2024-28782

IBM CVE-2024-28782 affects IBM QRadar Suite Software and IBM Cloud Pak for Security: QRadar Suite 1.10.12.0–1.10.18.0 and Cloud Pak for Security 1.10.0.0–1.10.11.0 store user credentials in plain clear text readable by an authenticated user. Root cause is plaintext credential storage, enabling in...

CVE-2024-27951

CVE-2024-27951 pertains to WordPress Multiple Page Generator Plugin (MPG) with versions up to 3.4.0. The issue is an Unrestricted Upload of a Dangerous File, enabling an attacker with Editor+ privileges to upload a web shell and achieve Remote Code Execution. The vulnerability is confirmed as exp...

CVE-2024-2322

CVE-2024-2322 affects the WordPress plugin WooCommerce Cart Abandonment Recovery prior to version 1.2.27. The vulnerability stems from missing CSRF protection in the plugin’s bulk actions, enabling CSRF attackers to cause logged-in admins to delete arbitrary email templates and to delete/unsubscr...

CVE-2023-35812

CVE-2023-35812 affects OpenSSH 7.4 in Amazon Linux 1/2. The issue stems from an incomplete mitigation for CVE-2019-6111: when a relative path is used with scp, the client does not verify that the received filename matches the requested one, allowing potential file misassociation. Public advisorie...

CVE-2024-28219

CVE-2024-28219 affects the Pillow Python imaging library. In _imagingcms.c, a buffer overflow was introduced because strcpy was used instead of a safer copy like strncpy, impacting Pillow before version 10.3.0. The issue filename and function indicate a likely overflow related to fixed-length str...

CVE-2024-30173

CVE-2024-30173 maps to an authentication bypass in the TYPO3 OpenID Connect Authentication extension. The TYPO3 extension’s authentication service does not verify the OpenID Connect authentication state from the user lookup chain and instead authenticates every valid frontend user whose tx_oidc f...

autonomia.org Cross Site Scripting vulnerability OBB-3896081

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

April 2, 2024, update for Office 2016 (KB5002452)

None None...

April 2, 2024, update for Office 2016 (KB5002572)

None None...

CVE-2024-26655 Fix memory leak in posix_clock_open()

In the Linux kernel, the following vulnerability has been resolved: Fix memory leak in posixclockopen If the clk ops.open function returns an error, we don't release the pccontext we allocated for this clock. Re-organize the code slightly to make it all more obvious...

Security Posture Management for GitHub: spotting and fixing risks in your GitHub organization just got a lot easier

Wiz SPM for version control systems helps you find and fix risks in your GitHub instance...

Authorization Bypass

Grafana vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to insufficient validation of organization IDs in the DeleteDashboardSnapshot within dashboardsnapshot.go. This allows an attacker to bypass authorization and delete a snapshot by sending a DELETE...

CVE-2023-50960

IBM QRadar SIEM is vulnerable to CVE-2023-50960, a stored cross-site scripting flaw in the Web UI. The IBM bulletin specifies affected product: IBM QRadar SIEM 7.5.0 UP7, with fix in 7.5.0 UP8; exploitation details are not provided beyond the stored XSS description, and the impact is potential cr...

UBUNTU-CVE-2024-1313

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

CVE-2024-1313 Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...