Exploit for Path Traversal in Iptanus Wordpress_File_Upload

CVE-2024-9047: Exploit for WordPress File Upload Plugin De...

ABB FLXEON Controllers

SUMMARY An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter. An attacker can...

Exploit for Protection Mechanism Failure in 7-Zip

7-Zip Mark-of-the-Web Bypass Vulnerability CVE-2025-0411 - P...

PT-2025-5363 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.55417 Description: The issue is related to the exposure of permanent tokens in logs, potentially allowing an attacker to obtain encrypted user credentials. This could be exploited through the...

CVE-2024-13176

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...

CVE-2024-55920 Cross-Site Request Forgery in Dashboard Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55923 Cross-Site Request Forgery in Indexed Search Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2025-21138

CVE-2025-21138 affects Substance3D Designer 14.0 and earlier. The issue is an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim must open a malicious file). A patch is available: update to a v...

2025-01 Cumulative Update for Windows 10 Version 1507 for x64-based Systems (KB5050013)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

.NET 8.0 Update - January 14, 2025 (KB5050525)

None None...

UBUNTU-CVE-2024-52319

In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in cleargiganticpage In current kernel, hugetlbnopage calls foliozerouser with the fault address. Where the fault address may be not aligned with the huge page size. Then, foliozerouser may call...

Exploit for Out-of-bounds Write in Vmware Cloud_Foundation

CVE-2021-21974 PoC - VMware ESXi RCE Exploit Descrição Est...

K000149247: Apache tomcat vulnerability CVE-2024-56337

Security Advisory Description Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users...

CVE-2024-12067

CVE-2024-12067 affects the WordPress plugin pair WP Travel – Ultimate Travel Booking System, Tour Management Engine, with vulnerable versions up to 10.0.0. The vulnerability is an SQL Injection in the wptravel_get_booking_data function caused by insufficient escaping of the booking_itinerary para...

Google Chrome < 131.0.6778.264 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 131.0.6778.264. It is, therefore, affected by a vulnerability as referenced in the 202501stable-channel-update-for-desktop advisory. - Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote...

Server-side Request Forgery (SSRF)

Overview timetagger is a Tag your time, get the insight - an open source time tracker for individuals Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to binding to 0.0.0.0:80 by default and not checking for localhost requests in the getwebtokenlocalhost...

PT-2025-39265

Name of the Vulnerable Software and Affected Versions pip affected versions not specified Description An issue exists in pip where it may not properly check symbolic links when extracting tar archives if the tarfile module does not implement PEP 706. This can occur when using Python versions that...

CVE-2024-56800 Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery SSRF vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address...

CVE-2024-56571

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2024-56616

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC aka message data CRC at the end of the message. This fixes a...