Rockwell Automation Logix Controllers Unprotected Alternate Channel (CVE-2024-6242)

A vulnerability exists in the affected products that allows a threat actor to bypass the Trusted Slot feature in a ControlLogix controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device...

CVE-2024-41811

ipl/web is a set of common web components for php projects. Some of the recent development by Icinga is, under certain circumstances, susceptible to cross site request forgery. CSRF. All affected products, in any version, will be unaffected by this once icinga-php-library is upgraded. Version...

CVE-2024-7311 code-projects Online Bus Reservation Site register.php sql injection

A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file register.php. The manipulation of the argument Email leads to sql injection. The attack may be initiated remotely. The exploit has been...

PT-2024-38257 · Unknown · Code-Projects Online Bus Reservation Site

Name of the Vulnerable Software and Affected Versions: code-projects Online Bus Reservation Site version 1.0 Description: A critical issue affects the processing of the file register.php, where the manipulation of the Email argument leads to sql injection. The attack can be initiated remotely...

ROS-20240729-22

A vulnerability in the packageindex module of the library designed to simplify the packaging of setuptools projects is related to functions used to download packages from URLs, provided by users or obtained from package index servers, are susceptible to code injection. Exploitation of the...

PINEAPPLE and FLUXROOT Hacker Groups Abuse Google Cloud for Credential Phishing

A Latin America LATAM-based financially motivated actor codenamed FLUXROOT has been observed leveraging Google Cloud serverless projects to orchestrate credential phishing activity, highlighting the abuse of the cloud computing model for malicious purposes. "Serverless architectures are attractiv...

CVE-2024-37422 WordPress Progress Planner plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Team Emilia Projects Progress Planner allows Stored XSS.This issue affects Progress Planner: from n/a through 0.9.2...

CVE-2024-37422 WordPress Progress Planner plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through = 0.9.2...

be.atbash.test:integration-testing (=2.2.0), be.atbash.test:integration-testing-database (=2.2.0) +511 more potentially affected by CVE-2024-41172 via org.apache.cxf:cxf-rt-transports-http (>=4.0.0 <=4.0.4)

org.apache.cxf:cxf-rt-transports-http MAVEN version =4.0.0, =1.0.0, =12.1-16, =0.0.1, =2.70.0, =2.71.1 - com.codbex.kronos:codbex-kronos-commons =2.70.0 - com.codbex.kronos:codbex-kronos-components-api-parent =2.69.0 - com.codbex.kronos:codbex-kronos-components-engine-xsjob =2.69.0 -...

The vulnerability of the IBM InfoSphere Information Server software platform, caused by deficiencies in the authentication process, allows attackers to modify arbitrary projects.

The vulnerability of the IBM InfoSphere Information Server software platform stems from deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to modify arbitrary projects...

CVE-2024-5817

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in internal repositories and required the attacker to have access to the corresponding project board. This vulnerability...

CVE-2024-5817

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed read access to issue content via GitHub Projects. This was only exploitable in internal repositories and required the attacker to have access to the corresponding project board. This vulnerability...

CVE-2024-6745 code-projects Simple Ticket Booking Login adminauthenticate.php sql injection

A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the file adminauthenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack...

CVE-2024-6745 code-projects Simple Ticket Booking Login adminauthenticate.php sql injection

A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the file adminauthenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack...

CVE-2024-6653 code-projects Simple Task List Login loginForm.php sql injection

A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginForm.php of the component Login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The...

CVE-2024-6653 code-projects Simple Task List Login loginForm.php sql injection

A vulnerability was found in code-projects Simple Task List 1.0. It has been declared as critical. This vulnerability affects unknown code of the file loginForm.php of the component Login. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The...

Geomys, a blueprint for a sustainable open source maintenance firm

In 2022, I left Google in search of a sustainable approach to open source maintenance. A year later, I was a full-time independent professional open source maintainer. Today I’m announcing the natural progression of that experiment: Geomys,1 a small firm of professional maintainers with a portfol...

WordPress Progress Planner Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Progress Planner Type Plugin Vulnerable versions = 0.9.2 Fixed in 0.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37422 Patch priority Medium CVSS severity Medium 6.5 Developer Emilia Projects PSID ae1b0a295095 Credits justakazh Required privilege...

CISA and Partners Release Guidance for Exploring Memory Safety in Critical Open Source Projects

Today, CISA, in partnership with the Federal Bureau of Investigation, Australian Signals Directorate’s Australian Cyber Security Centre, and Canadian Cyber Security Center, released Exploring Memory Safety in Critical Open Source Projects. This guidance was crafted to provide organizations with...

CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...