WordPress Currency per Product for WooCommerce Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Currency per Product for WooCommerce Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31920 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bdf124686da Credit...

Multiple programming languages fail to escape arguments properly in Microsoft Windows

Overview Various programming languages lack proper validation mechanisms for commands and in some cases also fail to escape arguments correctly when invoking commands within a Microsoft Windows environment. The command injection vulnerability in these programming languages, when running on Window...

CVE-2023-5574 affecting package xorg-x11-server for versions less than 1.20.10-10

CVE-2023-5574 affecting package xorg-x11-server for versions less than 1.20.10-10. A patched version of the package is available...

CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4

CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4. A patched version of the package is available...

CVE-2024-2496 affecting package libvirt for versions less than 7.10.0-8

CVE-2024-2496 affecting package libvirt for versions less than 7.10.0-8. A patched version of the package is available...

UBUNTU-CVE-2024-22423

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...

CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...

CVE-2024-31453 PsiTransfer vulnerable to violation of the integrity of file distribution

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability...

CVE-2024-29905

Summary: CVE-2024-29905 affects DIRAC prior to version 8.0.41. During the proxy generation process (e.g., dirac-proxy-init), unauthorized users on the same machine could gain read access to the proxy for a sub-millisecond window, enabling actions as if using the original proxy. The issue is mitig...

Exploit for Incorrect Authorization in Apple Macos

CVE-2023-42860 Exploit for CVE-2023-42860https://nvd.nist.g...

CVE-2024-28234

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. A...

CVE-2024-28234

Contao is affected when BBCode is enabled for comments, allowing CSS injection via BBCode in user comments. The issue affects Contao 2.0.0 and earlier, and versions prior to 4.13.40 and 5.3.4. Patch versions are Contao 4.13.40 and 5.3.4, which fix the vulnerability. As a workaround, disable BBCod...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester/ IBM DevOps Test UI

Summary There is vulnerability in Eclipse Jetty used by Rational Functional TesterRFT / DevOps Test UI Test UI. RFT/Test UI has addressed the applicable CVE-2024-22201. Vulnerability Details CVEID:CVE-2024-22201 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a flaw whe...

SUSE-SU-2024:1170-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831...

PT-2024-23579 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: An insecure logging issue allows attackers to obtain sensitive information due to inadequate security measures in the logging mechanisms. Recommendations: For ROS2 Galactic Geochelone version 2...

CVE-2024-31442

CVE-2024-31442 concerns Redon Hub, a Roblox Product Delivery Bot. Pre-1.0.2 versions permit all users to execute admin commands due to a permissions misconfiguration, allowing actions like receiving products for free and deleting/creating/updating products and tags. The only non-affected command ...

CVE-2024-31442 Redon-Hub has incorrect permissions on all admin related commands

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2024-30269 DataEase has database configuration information exposure vulnerability

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. The vulnerability has...

SUSE-SU-2024:1165-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - Upgrade from v1.25.14 to v1.25.16 - CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. bsc1219964...

SUSE-SU-2024:1138-1 Security update for guava

This update for guava fixes the following issues: - Upgrade to guava from v30.1.1 to v32.0.1 - CVE-2023-2976: Fixed Predictable temporary files and directories used in FileBackedOutputStream. bsc1212401 - CVE-2020-8908: Fixed a bug that could allow an attacker with access to the machine to...