CVE-2024-21412

creationtimestamp| type| source ---|---|--- 2024-02-13 19:17:24+00:00| seen| https://t.me/ctinow/184061 2024-02-13 20:37:03+00:00| seen| https://t.me/ctinow/184169 2024-02-13 20:41:42+00:00| seen| https://t.me/ctinow/184172 2024-02-13 20:41:43+00:00| seen| https://t.me/ctinow/184173 2024-02-13...

IBM Security Verify Access 信任管理问题漏洞

IBM Security Verify Access is a service from International Business Machines IBM that improves user access security. An elevation of privilege vulnerability exists in IBM Security Verify Access, which could be exploited by an attacker to install profiles that allow remote access...

PT-2024-1680 · Unknown · Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: Aria Operations for Networks affected versions not specified Description: The issue is related to a cross-site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile...

The vulnerability of the jas_image_decode() function in the JPC library, which allows an attacker to execute arbitrary code.

The vulnerability of the jasimagedecode function in the JPC library for the JasPer set is related to the issue where the operation exits the buffer boundaries during the processing of ICC profiles. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-22158

CVE-2024-22158 affects PeepSo Community: Photos plugin (

CVE-2024-22158 WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Network, Membership, Registration, User...

CVE-2024-0402

creationtimestamp| type| source ---|---|--- 2024-01-26 02:26:35+00:00| seen| https://t.me/ctinow/173953 2024-01-26 11:56:47+00:00| seen| https://t.me/ctinow/174171 2024-01-26 12:46:40+00:00| published-proof-of-concept| https://t.me/techb0ltGenona/4239 2024-01-28 13:16:07+00:00| seen|...

GitLab Tags RSS feed email disclosure

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It is possible to read the user email address via tags feed although the visibility in the user profile has been disabled. Module Options msf use...

DataHub Security Breach

DataHub is datahub-project's open source metadata platform for a modern data stack. A security vulnerability exists in versions of DataHub prior to 0.12.0 that stems from allowing a low-privileged user to delete a user, edit a group member, or edit another user's profile information...

CVE-2022-36352

Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3...

CVE-2022-36352

Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3...

CVE-2022-36352

CVE-2022-36352 affects WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin. The issue is a Missing Authorization/Broken Access Control vulnerability in versions up to 5.0.3, allowing unauthorized access to certain actions/data. PatchStack specifies a fix in version 5...

PT-2024-14466 · WordPress · Armember

Name of the Vulnerable Software and Affected Versions: ARMember – Membership Plugin affected versions not specified Description: The issue is related to Cross-Site Request Forgery CSRF and Deserialization of Untrusted Data. This affects the membership plugin, content restriction, member levels,...

Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset

Information stealing malware are actively taking advantage of an undocumented Google OAuth endpoint named MultiLogin to hijack user sessions and allow continuous access to Google services even after a password reset. According to CloudSEK, the critical exploit facilitates session persistence and...

Sesami Cash Point & Transport Optimizer Security Vulnerability

Sesami Cash Point & Transport Optimizer is a solution from Sesami Corporation. A security vulnerability exists in Sesami Cash Point & Transport Optimizer CPTO version 6.3.8.6 that stems from the presence of a CSV injection vulnerability. The vulnerability allows remote attackers to obtain sensiti...

CVE-2023-50719

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

Default credentials

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

CVE-2023-50719 XWiki Platform Solr search discloses password hashes of all users

XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are...

CVE-2023-50719

XWiki Platform’s Solr-based search discloses password hashes (and potentially API keys stored as passwords) of all users to anyone with view rights on the user profile. Affected versions are 7.2-milestone-2 through prior to 14.10.15, 15.5.2, and 15.7-rc-1. By default, user profiles are public, en...

CVE-2023-6563

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens 500,000 users with each having at least 2 saved sessions. If an attacker creates two or more user sessions and then open the "consents" tab of th...