CVE-2024-2377: Origin Validation Error

A vulnerability exists in the too permissive HTTP response header web server settings of the SDM600. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information...

PT-2024-25210 · Jizhicms · Jizhicms

Name of the Vulnerable Software and Affected Versions: jizhicms version 2.5.4 Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via a crafted article publication request. Recommendations: For jizhicms version 2.5.4, at the moment, there is no...

CVE-2024-33271

An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the pscustomer component...

CVE-2024-33350

Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/file.php component...

SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co. Ltd (CNVD-2024-24538)

T+ is a new Internet-based business management software. Ltd. A SQL injection vulnerability exists in Changjitong T+, which can be exploited by attackers to obtain sensitive information from the database...

CVE-2024-3623: Plaintext Storage of a Password

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. Th...

CVE-2024-1132 Keycloak: path transversal in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

CVE-2024-1132: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

Weak Password Vulnerability in RG-ISG of Ruijie Networks Co.

Ruijie Networks Corporation is an industry-leading provider of network infrastructure and solutions. A weak password vulnerability exists in the RG-ISG of Ruijie Networks Corporation, which can be exploited by attackers to obtain sensitive information...

Advisory ROSA-SA-2024-2398

software: git 2.41.0 WASP: ROSA-CHROME packageevrstring: git-2.41.0-2.src.rpm CVE-ID: CVE-2022-23521 BDU-ID: 2023-00499 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the attribute definition mechanism for the gitattributes paths of the Git distributed version control system is related to...

PT-2024-14915 · WordPress · Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Inline Related Posts WordPress plugin versions prior to 3.6.0 Description: The issue is related to missing authorization in an AJAX action, which allows any authenticated user, such as a subscriber, to retrieve the content of password-protect...

CVE-2024-30713

CVE-2024-30713 entry is rejected/not used and does not represent an active vulnerability.

CVE-2024-30719

CVE-2024-30719 is rejected; this candidate is not used and does not reflect an active vulnerability entry.

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. This flaw allows an attacker with physical or local access to a computer where...

CVE-2024-3545

Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a compute...

CVE-2024-30678

CVE-2024-30678 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-31816

In TOTOLINK EX200 V4.0.3c.7646B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg...

SQL Injection Vulnerability in Crypto M8 Integration Management Platform of Xiamen Crypto Information Technology Co.

Founded in 2007, Xiamen Crypto Information Technology Co., Ltd. is a vendor specializing in the development of integration management software. A SQL injection vulnerability exists in the Crypto M8 Integration Management Platform of Xiamen Crypto Information Technology Co. Ltd, which can be...

Weak password vulnerability in InVid Tech of Shenzhen Tongwei Digital Technology Co.

Shenzhen Tongwei Digital Technology Co., Ltd. is a research and development, production, sales and service in one of the video security field of international - streaming products and system solutions provider. Shenzhen Tongwei Digital Technology Co., Ltd InVid Tech There is a weak password...

CVE-2023-42936

CVE-2023-42936 affects Apple platforms and is connected to Apple’s update fixing an issue where an app may access user-sensitive data due to improved redaction of sensitive information. The public entry lists fixes in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2, iPadOS 17.2, tvOS 17.2, ...