2312 matches found
WordPress Bit File Manager Plugin <= 6.5.5 is vulnerable to Arbitrary File Upload
Software Bit File Manager Type Plugin Vulnerable versions = 6.5.5 Fixed in 6.5.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7770 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 4d22ee982f55 Credits TANG Cheuk Hei siunam Required privileg...
WordPress Floating Contact Button Plugin < 2.8 is vulnerable to Cross Site Scripting (XSS)
Software Floating Contact Button Type Plugin Vulnerable versions 2.8 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7891 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2bb2b652e147 Credits Kientt Required...
WordPress Tutor LMS Plugin <= 2.7.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Tutor LMS Type Plugin Vulnerable versions = 2.7.4 Fixed in 2.7.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2919 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a0dbe6193554 Credits Ram Required privilege...
KB5043936: Servicing stack update for Windows 10: September 10, 2024
None None...
KB5042881: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (September 2024)
The remote Windows host is missing security update 5042881 or hotpatch update 5042880. It is, therefore, affected by multiple vulnerabilities - Windows MSHTML Platform Spoofing Vulnerability CVE-2024-43461 - Windows Remote Desktop Licensing Service Spoofing Vulnerability CVE-2024-43455 - Windows...
Security Updates for Microsoft Excel Products (September 2024)
The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerability: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2024-43465 Note that Nessus has not tested for this issue but has instead...
Security Updates for Microsoft Office Products (September 2024) (macOS)
The version of Microsoft Office for Mac installed on the remote host is affected by a vulnerability as referenced in the september-10-2024 advisory. - Microsoft Excel Elevation of Privilege Vulnerability CVE-2024-43465 Note that Nessus has not tested for this issue but has instead relied only on...
CVE-2024-27387
creationtimestamp| type| source ---|---|--- 2024-09-09 23:10:41+00:00| seen| https://t.me/cvedetector/5135...
CVE-2024-45411
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0...
CVE-2024-24510
Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function to the mail component...
CVE-2024-8558
creationtimestamp| type| source ---|---|--- 2024-09-07 19:20:40+00:00| seen| https://t.me/cvedetector/5036...
WordPress Frontend Post Submission Manager Lite Plugin <= 1.2.2 is vulnerable to Broken Access Control
Software Frontend Post Submission Manager Lite Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8427 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ea5d9d3b8976 Credits Lucio Sá...
CVE-2024-45157
An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLSPSAHMACDRBGMDTYPE does not cause the PSA subsystem to use HMACDRBG: it uses HMACDRBG only when MBEDTLSPSACRYPTOEXTERNALRNG and...
CVE-2024-45158
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtlsecdsadertoraw and mbedtlsecdsarawtoder can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. This never happen...
CVE-2024-8445
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input...
Abusix Launches Guardian: Cutting-Edge Security Platform for Email and Network Providers
Boston, MA, 5th September 2024, CyberNewsWire...
CVE-2024-43102
creationtimestamp| type| source ---|---|--- 2024-09-05 07:59:21+00:00| seen| https://t.me/cvedetector/4884 2024-09-10 09:25:48+00:00| seen| https://t.me/HackingInsights/12620 2024-09-12 16:30:06+00:00| published-proof-of-concept| https://t.me/truesecator/6200...
CVE-2024-34653
Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege...