CVE-2024-6448 Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure

The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full...

WordPress plugin Mollie Payments for WooCommerce 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

PT-2024-37635 · WordPress · Mollie Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Mollie Payments for WooCommerce plugin for WordPress versions up to, and including, 7.7.0 Description: The issue is related to information exposure due to error reporting being enabled by default in multiple plugin files. This allows...

[SECURITY] Fedora 39 Update: zabbix-6.0.33-1.fc39

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

PT-2024-7989 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924 Description: The issue is related to insecure expression evaluation, allowing for object injection and potentially leading to code execution attacks. This can be exploited by...

apollo-portal has potential unauthorized access issue

Impact A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. Patches The issue was addressed with an input parameter check in...

Dell Storage Resource Manager Session Interception

The vulnerability of the Dell Storage Resource Manager and Dell Storage Monitoring and Reporting software agents relates to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to intercept the ongoing user session remotely...

UBUNTU-CVE-2024-42304

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this...

venue1012.com Cross Site Scripting vulnerability OBB-3958053

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-6129 · Ibm · Ibm Qradar Suite +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Software versions 1.10.12.0 through 1.10.22.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue is related to weaknesses in the error reporting mechanism of IBM QRadar Suite and IBM Cloud P...

Persistent Cross-site Scripting in eZ Platform Rich Text Field Type

Impact The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which...

GHSA-RHM7-7469-RCPW Persistent Cross-site Scripting in eZ Platform Rich Text Field Type

Impact The validator for the RichText fieldtype blocklists javascript: and vbscript: in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which...

CVE-2024-27443

creationtimestamp| type| source ---|---|--- 2024-08-12 18:27:16+00:00| seen| https://t.me/cvedetector/2848 2025-05-16 21:02:20+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lpcwgiwche26 2025-05-19 18:00:16+00:00| seen|...

Security Bulletin: Multiple Security Vulnerabilities in IBM Java Runtime affect IBM License Key Server Administration and Reporting Tool and its Agent

Summary Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition in IBM License Key Server Administration and Reporting Tool ART and Administration Agent. For more information please refer to Oracle's CPU Advisory and the X-Force database entries referenced below. Vulnerability Details...

shinyoungspice.com Cross Site Scripting vulnerability OBB-3954763

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

s2n-tls's mTLS API ordering may skip client authentication

Impact An API ordering issue in s2n-tls can cause client authentication to unexpectedly not be enabled on the server when it otherwise appears to be. Server applications are impacted if client authentication is enabled by calling s2nconnectionsetconfig before calling s2nconnectionsetclientauthtyp...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using the -Xgc:concurrentScavenge option on IBM Z is vulnerable to Buffer overflow in GC

Summary CVE-2024-3933 affects IBM SDK, Java Technology Edition. An update has been released to address the vulnerability. Following IBM® Engineering Lifecycle Engineering product is vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test Management, IBM Jazz...

CVE-2024-7512 Concrete CMS Stored XSS in Board instances

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in Board instances. A rogue administrator could inject malicious code. The Concrete CMS security team gave this vulnerability a CVSS 4.0 Score of 4.6 with vector:...

(0Day) Microsoft Windows Error Reporting Service Missing Authorization Arbitrary Process Termination Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...

Argo CD Error Reporting Unauthorized Access

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to shortcomings in the error reporting mechanism. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...