CVE-2024-22189

The CVE concerns quic-go prior to v0.42.0 where an attacker can cause memory exhaustion on the peer by flooding with NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is expected to reply with RETIRE_CONNECTION_ID frames for each retirement; an attacker can prevent most of the...

iscchina.org Cross Site Scripting vulnerability OBB-3901499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

Esri Portal For ArcGIS 跨站脚本漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS that stems from vulnerability to cross-site scripting attac...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

Esri Portal For ArcGIS 安全漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal For ArcGIS that stems from the presence of a cross-site scripting vulnerability...

CVE-2024-22360

CVE-2024-22360 (IBM Db2 on Cloud Pak for Data) is a denial-of-service issue triggered by a specially crafted query on certain columnar tables. Affected products include IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, with versions listed as v3.5 through various refresh leve...

CVE-2023-52296

Technical details about CVE-2023-52296 are not publicly provided in the connected documents. The available description notes a denial-of-service when querying a specific UDF concurrently in IBM Db2 11.5. Monitor for updates.

CVE-2024-25046

CVE-2024-25046 affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Authenticated user can trigger a denial of service via a specially crafted query against Db2 components (versions 3.5 through latest refresh). The issue has a remediation path: upgrade to the latest Cloud...

CVE-2024-25030

CVE-2024-25030 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (v3.5–refresh 10, v4.0–refresh 9, v4.5–refresh 3, v4.6–refresh 6, v4.7–refresh 4, v4.8–refresh 4). The issue is that 11.1 releases store potentially sensitive information in log files readable by a local ...

CVE-2024-25918

CVE-2024-25918 affects the WordPress plugin InstaWP Connect (InstaWP) Suite. The vulnerability is described as Unrestricted Upload of File with Dangerous Type, enabling remote code execution (RCE). Affected versions: InstaWP Connect from n/a through 0.1.0.8. Public writeups/reports in connected d...

CVE-2024-27191

CVE-2024-27191 concerns the WordPress plugin Slivery Extender (Inpersttion Slivery Extender). Public sources describe an "ImpropER Control of Generation of Code (Code Injection)" vulnerability that enables an authenticated attacker (Contributor+) to execute arbitrary code via the plugin’s shortco...

CVE-2024-28782

IBM CVE-2024-28782 affects IBM QRadar Suite Software and IBM Cloud Pak for Security: QRadar Suite 1.10.12.0–1.10.18.0 and Cloud Pak for Security 1.10.0.0–1.10.11.0 store user credentials in plain clear text readable by an authenticated user. Root cause is plaintext credential storage, enabling in...

CVE-2024-27951

CVE-2024-27951 pertains to WordPress Multiple Page Generator Plugin (MPG) with versions up to 3.4.0. The issue is an Unrestricted Upload of a Dangerous File, enabling an attacker with Editor+ privileges to upload a web shell and achieve Remote Code Execution. The vulnerability is confirmed as exp...

CVE-2024-2322

CVE-2024-2322 affects the WordPress plugin WooCommerce Cart Abandonment Recovery prior to version 1.2.27. The vulnerability stems from missing CSRF protection in the plugin’s bulk actions, enabling CSRF attackers to cause logged-in admins to delete arbitrary email templates and to delete/unsubscr...

CVE-2023-35812

CVE-2023-35812 affects OpenSSH 7.4 in Amazon Linux 1/2. The issue stems from an incomplete mitigation for CVE-2019-6111: when a relative path is used with scp, the client does not verify that the received filename matches the requested one, allowing potential file misassociation. Public advisorie...

CVE-2024-28219

CVE-2024-28219 affects the Pillow Python imaging library. In _imagingcms.c, a buffer overflow was introduced because strcpy was used instead of a safer copy like strncpy, impacting Pillow before version 10.3.0. The issue filename and function indicate a likely overflow related to fixed-length str...

CVE-2024-30173

CVE-2024-30173 maps to an authentication bypass in the TYPO3 OpenID Connect Authentication extension. The TYPO3 extension’s authentication service does not verify the OpenID Connect authentication state from the user lookup chain and instead authenticates every valid frontend user whose tx_oidc f...

autonomia.org Cross Site Scripting vulnerability OBB-3896081

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...