Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server version v11.7.31, which stems from a comparison of URIs before normalization and canonicalization in a protocol handler function, which may result in an...

CVE-2024-52534

Dell ECS, versions prior to ECS 3.8.1.3, contains an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft...

PT-2024-40265 · Libafl · Libafl

Name of the Vulnerable Software and Affected Versions: LibAFL versions prior to 0.11.2 Description: The issue arises from the misuse of the slice::from raw parts mut API, where a pointer is misaligned due to a direct cast from u8 to u16 raw pointer, leading to unsound behavior. The problem is...

Malicious code in 4m-clean-shopify-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff1dc78c54862db7c3a030ea6817abc308fbdfe0d28be84a7203e062ab025963 Any computer that has this package install...

MAL-2025-8 Malicious code in 4m-clean-shopify-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff1dc78c54862db7c3a030ea6817abc308fbdfe0d28be84a7203e062ab025963 Any computer that has this package install...

PT-2024-36795 · Unknown · Onyxia-Api

Name of the Vulnerable Software and Affected Versions: Onyxia-API versions prior to 2.8.2 Onyxia-API versions prior to 3.1.1 Onyxia-API versions prior to 4.2.0 Description: This issue allows authenticated users to remotely execute code within the Onyxia-API, potentially leading to unauthorized...

PT-2024-9851 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.12 Description: The issue is related to the exposure of user credentials and session cookies in backup files. This is due to incorrect removal of critical data. An attacker could exploit this to revea...

CVE-2024-54790

A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execute arbitrary code via the visittime parameter...

CVE-2023-4617 Gaining remote control over Govee devices

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

CVE-2024-54790: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /index.php in PHPGurukul Pre-School Enrollment System v1.0, which allows remote attackers to execute arbitrary code via the visittime parameter...

PT-2024-36420

Name of the Vulnerable Software and Affected Versions PHPGurukul Pre-School Enrollment System version 1.0 Description A SQL Injection issue was found in the /index.php file, allowing remote attackers to execute arbitrary code via the visittime parameter. Recommendations For PHPGurukul Pre-School...

CVE-2024-54790

A SQL Injection vulnerability exists in the PHPGurukul Pre-School Enrollment System v1.0 within the /index.php file. This flaw is caused by improper neutralization of special elements used in an SQL command, specifically via the visittime parameter. Remote attackers can exploit this to execute ar...

AZL-54410 CVE-2024-45338 affecting package node-problem-detector for versions less than 0.8.15-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54428 CVE-2024-45338 affecting package cert-manager for versions less than 1.12.15-1

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

Misskey 代码问题漏洞

Misskey is a perpetually free open source syndicated social media platform from Misskey Open Source. A code issue vulnerability exists in versions prior to Misskey 2024.11.0-alpha.3 that stems from not properly checking the target host and allows an attacker to send a POST or GET request to an...

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Instructor+ SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WPLMS versions 1.9.9.5.3...

Next.js 授权问题漏洞

Next.js is a React framework open-sourced by Vercel. An authorization issue vulnerability exists in versions of Next.js prior to 14.2.15, which stems from the fact that if an application performs authorization in middleware based on a pathname, a page in the root directory of the application may...

WinPmem 安全漏洞

WinPmem is an open source physical memory acquisition tool from Velocidex. A security vulnerability exists in WinPmem version 4.1 and earlier versions that stems from improper validation of input...

PT-2024-36551 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.10.43 Description: The issue allows remote code execution from a pre-authenticated route when an attacker knows the APP KEY. This is exacerbated by .env files that have default APP KEY values. The route...