CVE-2024-52550

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

CVE-2024-52553

Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b6d and earlier does not invalidate the previous session on login...

Jenkins plugin OpenId Connect Authentication 代码问题漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

PT-2024-35372 · Jenkins · Jenkins Pipeline: Groovy Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 3990.vd281dd77a 388 and earlier, except version 3975.3977.v478dd9e956c3 Description: The issue allows attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no...

.NET 6.0 Update - November 12, 2024 (KB5047486)

None None...

WordPress plugin WordPress Mega Menu 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from the ability to point to the previous byte of a string pointer if the lastbytep string is null...

SUSE CVE-2021-37577

Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...

Rocket.Chat 安全漏洞

Rocket.Chat is a chat program from Rocket.Chat Inc. A security vulnerability exists in Rocket.Chat. An attacker exploiting this vulnerability is able to abuse the UpdateOTRAck method. The following versions are affected: version 6.12.0, version 6.11.2, version 6.10.5, version 6.9.6, version 6.8.6...

Concrete CMS Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.4 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. Since the "Next&Previous Nav" block output was not sufficiently sanitized, th...

GHSA-XMXJ-V2Q8-8QX6 Concrete CMS Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.4 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. Since the "Next&Previous Nav" block output was not sufficiently sanitized, th...

CVE-2024-8661

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6...

CVE-2024-8661 Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6...

CVE-2024-8661 Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block

Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6...

CVE-2024-8661

Concrete CMS is affected by CVE-2024-8661 due to Stored XSS in the Next&Previous Nav block. Affected versions are 9.0.0 to 9.3.3 and below 8.5.19 (per initial description; some sources cite 9.3.4 and 8.5.18 in other records). The root cause is insufficient sanitization/output cleanup in the Next&...

PT-2024-39159 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9.0.0 through 9.3.4 Concrete CMS versions below 8.5.19 Description: A Stored XSS vulnerability exists in the "Next&Previous Nav" block of Concrete CMS, allowing a rogue administrator to add a malicious payload that can b...

PT-2024-38031 · Unknown · Control Fpwin Pro

Name of the Vulnerable Software and Affected Versions: Control FPWIN Pro versions 7.7.2.0 and all previous versions Description: A stack-based buffer overflow in Control FPWIN Pro may allow attackers to execute arbitrary code via a specially crafted project file. This issue can be exploited by...

PT-2024-5990

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.16 Description The issue is related to Server-Side Request Forgery SSRF and Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This vulnerability may allow a remote...

PT-2024-22672 · Intel · Intel Vtune Profiler

Name of the Vulnerable Software and Affected Versions: IntelR VTuneTM Profiler versions prior to 2024.1 Description: The issue is related to an uncontrolled search path in some IntelR VTuneTM Profiler software, which may allow an authenticated user to potentially enable escalation of privilege vi...