31906 matches found
CVE-2024-21538 affecting package reaper for versions less than 3.1.1-15
CVE-2024-21538 affecting package reaper for versions less than 3.1.1-15. A patched version of the package is available...
CVE-2024-37050
CVE-2024-37050 is a buffer copy vulnerability affecting QNAP QTS and QuTS hero prior to the fixed versions. The issue allows code execution by remote attackers who have gained administrator access, as described in multiple sources. Affected versions require upgrading to: QTS 5.2.1.2930 build 2024...
Microsoft Edge (Chromium-Based) Spoofing Vulnerability - Nov24
Microsoft Edge Chromium-Based is prone to a spoofing vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Rancher Helm Applications may have sensitive values leaked
Impact A vulnerability has been identified within Rancher Manager whereby applications installed via Rancher Manager Apps Catalog store their Helm values directly into the Apps Custom Resource Definition, resulting in any users with GET access to it to be able to read any sensitive information th...
Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation
Oracle is warning that a high-severity security flaw impacting the Agile Product Lifecycle Management PLM Framework has been exploited in the wild. The vulnerability, tracked as CVE-2024-21287 CVSS score: 7.5, could be exploited sans authentication to leak sensitive information. "This vulnerabili...
PT-2024-22850 · Kasda · Kasda Linksmart Router Kw6512
Name of the Vulnerable Software and Affected Versions: Kasda LinkSmart Router KW6512 versions = v1.3 Description: The issue is related to Multiple OS Command Injection vulnerabilities. An authenticated remote attacker can execute arbitrary OS commands via various cgi parameters. Recommendations:...
Security Bulletin: Security vulnerability CVE-2024-39689 in Certifi python-certifi that is used by FileNet Content Manager and CP4BA - Filenet Content Manager Component
Summary Security vulnerability CVE-2024-39689 in Certifi python-certifi that is used by FileNet Content Manager and CP4BA - Filenet Content Manager Component in container Operator Vulnerability Details CVEID:CVE-2024-39689 DESCRIPTION: Certifi python-certifi could provide weaker than expected...
Statamic CMS has a Path Traversal in Asset Upload
Assets uploaded with appropriately crafted filenames may result in them being placed in a location different than what was configured. Impact - Affects front-end forms with assets fields. - Affects other places where assets can be uploaded, although users would need upload permissions anyway. -...
WordPress What Would Seth Godin Do Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)
Software What Would Seth Godin Do Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51900 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 82273a1e93d0 Credits FX Required privilege...
WordPress Wawp Plugin < 3.0.18 is vulnerable to Broken Authentication
Software Wawp Type Plugin Vulnerable versions 3.0.18 Fixed in 3.0.18 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-52475 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 4c22e2281ddc Credits stealthcopter...
Cisco Firepower Management Center Software RCE (cisco-sa-openssh-rce-2024)
A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Note that Nessu...
Cisco Firepower Management Center Software RCE (cisco-sa-openssh-rce-2024)
A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. Note that Nessu...
SUSE-SU-2024:4036-1 Security update for httpcomponents-client, httpcomponents-core
This update for httpcomponents-client, httpcomponents-core fixes the following issues: httpcomponents-client: - Update to version 4.5.14 HTTPCLIENT-2206: Corrected resource de-allocation by fluent response objects. HTTPCLIENT-2174: URIBuilder to return a new empty list instead of unmodifiable...
CVE-2024-37155
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...
CVE-2024-37155 OpenCTI May Bypass Introspection Restriction
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...
Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites
A critical authentication bypass vulnerability has been disclosed in the Really Simple Security formerly Really Simple SSL plugin for WordPress that, if successfully exploited, could grant an attacker to remotely gain full administrative access to a susceptible site. The vulnerability, tracked as...
PT-2024-30574 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue allows an unauthenticated user to use an application endpoint to check if an email address corresponds to a valid GLPI user. Recommendations: For versions 0.80 through 10.0.16, update ...
Exploit for CVE-2024-49379
Proof of Concept PoC for CVE-2024-49379 This repository con...
CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...
