6007 matches found
CVE-2024-22213
CVE-2024-22213 affects Nextcloud Deck (kanban-style app) and enables cross-site scripting via HTML submitted as a comment. The root cause is untrusted HTML execution in the Deck comment flow, allowing malicious code to run in a user’s browser. Affected versions include Deck 1.9.x and 1.10.x lines...
CVE-2032-43016
Technical details for CVE-2032-43016 are not publicly available in the provided documents; monitoring for updates is advised.
CVE-2021-234550
CVE-2021-234550 affects IBM Spectrum Control (versions 5.4.0–5.4.5.2). The issue is a Dojo prototype pollution in setObject that could allow a remote attacker to execute arbitrary code by sending a specially crafted request. IBM lists a fix in Spectrum Control v5.4.6. Other related advisories not...
HackerOne: Program admins could add verified domains to an organization
Program admins could add verified domains to an organization in HackerOne despite lacking organization admin permissions. This allowed program admins to access restricted features and escalate privileges...
GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials
GitHub has revealed that it has rotated some keys in response to a security vulnerability that could be potentially exploited to gain access to credentials within a production container. The Microsoft-owned subsidiary said it was made aware of the problem on December 26, 2023, and that it address...
CVE-2024-0200
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...
CVE-2024-0200
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...
CVE-2024-0200 Unsafe Reflection in Github Enterprise Server leading to Command Injection
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...
CVE-2024-21680
A RCE vulnerability (CVSS 3.0: AV=L/AC=L/PR=N/UI=R/S=U/C/H/I/H/A:H) was introduced in Sourcetree for Mac and Sourcetree for Windows version 3.4.14. The issue allows an unauthenticated attacker to execute arbitrary code with high impact to confidentiality, integrity, and availability, requiring us...
CVE-2023-34063
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...
CVE-2022-45592
CVE-2022-45592 is discussed in connected documents as affecting Linux distributions (notably Debian/Ubuntu) with a set of issues: Server-Side Request Forgery (SSRF), persistent Cross-Site Scripting (XSS), and a File Upload vulnerability. The Nessus NASL notes unpatched status for Debian/Ubuntu pa...
CVE-2023-34854
CVE-2023-34854 corresponds to an authenticated remote code execution vulnerability in HotelDruid via its backup/restore functionality. Multiple connected sources (Ubuntu/Debian trackers, Veracode, PT-Security, and Nessus) confirm RCE through backup/restore, with no explicit patch/version details ...
CVE-2023-48783
An Authorization Bypass Through User-Controlled Key vulnerability CWE-639 affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other...
Fortinet PortiPortal Security Vulnerability
Fortinet PortiPortal is a cloud-based multi-tenant portal from Fortinet, Inc. for security policy management and analysis. A security vulnerability exists in Fortinet PortiPortal version 7.2.1 and earlier, version 7.0.6 and earlier, version 6.0.14 and earlier, and version 5.3.8. An attacker could...
PT-2024-13651 · Unknown · Portiportal
Name of the Vulnerable Software and Affected Versions: PortiPortal versions 7.2.1 and below PortiPortal versions 7.0.6 and below PortiPortal versions 6.0.14 and below PortiPortal versions 5.3.8 and below Description: The issue allows a remote authenticated user with at least read-only permissions...
Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign
...
webmail.kapsam.org Cross Site Scripting vulnerability OBB-3829519
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-43876
CVE-2022-43876 affects IBM Security Verify Access OpenID Connect Provider container. The IBM bulletin states an information-disclosure flaw where web pages can be stored locally by the OIDC Provider and read by another user on the same system. Affected IBM Security Verify Access OIDC Provider ver...
pmq.org.hk Cross Site Scripting vulnerability OBB-3828398
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
