Overleaf 安全漏洞

Overleaf is an open source online real-time collaborative LaTeX editor from Overleaf Open Source. A security vulnerability exists in Overleaf. An attacker can exploit the vulnerability to load a dictionary file with an arbitrary filename...

gitoxide 安全漏洞

gitoxide is a git implementation written in Rust by the individual developer Sebastian Thiel. A security vulnerability exists in gitoxide versions prior to 0.10.10. An attacker can exploit this vulnerability to obtain sensitive information...

Halo 安全漏洞

Halo is a powerful and easy-to-use open source website builder from Halo Open Source. A security vulnerability exists in Halo versions prior to 2.17.0. An attacker exploited the vulnerability to execute malicious scripts in a user's browser via specific HTML and JavaScript code...

Organizr 安全漏洞

Organizr is a tab management system for causefx individual developers. It is intended to be a one-stop store for server front-ends. A security vulnerability exists in Organizr v1.90, which stems from a cross-site scripting XSS vulnerability via api.php...

Organizr 安全漏洞

Organizr is a tab management system for causefx individual developers. It is intended to be a one-stop store on the front end of the server. A security vulnerability exists in Organizr v1.90, which stems from a SQL injection vulnerability via chat/settyping.php...

Xiaomi GetApps 安全漏洞

Xiaomi GetApps is a global app store by Chinese company Xiaomi. It is used by developers to publish and distribute their apps to over 200 million users in 59 regions. A security vulnerability exists in Xiaomi GetApps that stems from a bypass of the authentication logic, which could allow an...

JustEnoughItems 安全漏洞

JustEnoughItems JEI is a project and recipe viewing module for Minecraft by James Mitchell, an individual developer. A security vulnerability exists in JustEnoughItems version 19.5.0.33 and prior versions, which stems from an inability to validate Minecraft's slot index in JEI, which can lead to...

RuoYi 安全漏洞

RuoYi is a back-end management system by the individual developer of RuoYi in China. A security vulnerability exists in RuoYi v4.7.9, which is caused by a cross-site scripting XSS vulnerability in the sql parameter of the createTable function at /tool/gen/create...

ZOHO ManageEngine ADAudit Plus SQL Injection Vulnerability (CNVD-2024-37483)

ZOHO ManageEngine ADAudit Plus is ZOHO's solution for simplifying audits, proving compliance and detecting threats. ZOHO ManageEngine ADAudit Plus prior to version 8000 suffers from a SQL injection vulnerability that can be exploited by an attacker to execute custom queries and access database...

CentralSquare CryWolf 安全漏洞

CentralSquare CryWolf is a misinformation management system from CentralSquare, Inc. A security vulnerability exists in CentralSquare CryWolf that stems from GeneralDocs.aspx containing a path traversal vulnerability...

Chisel 安全漏洞

Chisel is a fast TCP/UDP tunnel for Jaime Pillora Personal Developer. A security vulnerability exists in Chisel versions prior to v1.10.0 that stems from the server not reading the AUTH environment variable used to set authentication credentials, which could result in any unauthenticated user bei...

K000140784: Apache HTTPD vulnerability CVE-2024-38477

Security Advisory Description null pointer dereference in modproxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38477 Impact Attackers can exploit this...

PT-2024-30003 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: publiccms versions V4.0.202302.e and before Description: The issue concerns an Any File Upload vulnerability via the "publiccms/admin/cmsTemplate/saveMetaData" endpoint. This allows unauthorized file uploads, potentially leading to security...

GO-2023-2398 lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs...

Detecting AWS Account Compromise: Key Indicators in CloudTrail Logs for Stolen API Keys

As cloud infrastructure becomes the backbone of modern enterprises, ensuring the security of these environments is paramount. With AWS Amazon Web Services still being the dominant cloud it is important for any security professional to know where to look for signs of compromise. AWS CloudTrail...

pharmacy-manage-system 安全漏洞

pharmacy-manage-system is a pharmacy management system by Krishna Aryal, an individual developer. A security vulnerability exists in pharmacy-manage-system, which stems from an SQL injection vulnerability in the invoicenumber parameter of the salesreport.php page...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco versions prior to 14.1.2 that stems from an authenticated user having access to some unintended endpoints...

Han ERP 安全漏洞

Han ERP is an ERP import/export system developed by Han Individual Developer. A security vulnerability exists in the ERP that originates from the /index.php/basedata/contact/delete?action=delete location that contains a SQL injection vulnerability...

Han ERP 安全漏洞

Han ERP is an ERP import/export system developed by Han Individual Developer. Han ERP has a security vulnerability that originates from the /index.php/basedata/inventory/delete?action=delete location contains a SQL injection vulnerability...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google USA. Google Pixel has a security vulnerability that stems from improper locking and possible post-release reuse, leading to escalation of local privileges...