CVE-2024-25344

Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settingsdefaults.php,settingsintegrations.php,...

swaggerHole - A Python3 Script Searching For Secret On Swaggerhub

Introduction This tool is made to automate the process of retrieving secrets in the public APIs on swaggerHub. This tool is multithreaded and pipe mode is available : Requirements - python3 sudo apt install python3 - pip3 sudo apt install python3-pip Installation pip3 install swaggerhole or...

AZL-39887 CVE-2024-26595 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fix NULL pointer dereference in error path When calling mlxswspacltcamregiondestroy from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon...

Exploit for Path Traversal in Jenkins

🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 ============= ---------...

February 13, 2024—KB5034830 (Monthly Rollup)

None None...

CVE-2023-4539 Hardcoded password in Comarch ERP XL

Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installations. This issue affects ERP XL: from 2020.2.2 through 2023....

CVE-2023-4539

The connected Red Hat advisories confirm CVE-2023-4539 is a hard-coded password flaw in Comarch ERP XL installations, enabling retrieval of embedded sensitive data via a special database account created during installation. Affected scope: ERP XL versions 2020.2.2–2023.2. The root cause is a univ...

Directory traversal

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer FAL could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve...

February 13, 2024—KB5034809 (Security-only update)

None None...

February 13, 2024—KB5034831 (Monthly Rollup)

None None...

CVE-2024-22454

Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the compromise...

AAD Pod Identity obtaining token with backslash

...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2023-46747 Exploit Script This script exploits the F5 B...

CVE-2024-0595 Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpasgetusers function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with...

CVE-2023-46350

SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" idxrmanufacturer module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink,...

Spring Tips: Spring AI

Hi, Spring fans! In this installment we'll look at the new Spring AI project, which provides convenient integrations with LLMs like the one behind ChatGPT and tools to support the RAG retrieval augmented generation pipeline. ai springboot artificialintelligence java graalvm cloud java21 postgresq...

CVE-2024-22021

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role Plan Author to retrieve plans from a Scope other than the one they are assigned to...

CVE-2024-22021

Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role Plan Author to retrieve plans from a Scope other than the one they are assigned to...

WordPress Better Search Replace Plugin < 1.4.5 PHP Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:deliciousbrains:bettersearchreplace"; if description...

Deserialization of untrusted data

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...