CVE-2024-37162

CVE-2024-37162 affects the zsa library for Next.js. The vulnerability arises because the application transfers the parse error stack from server to client in production builds, potentially exposing sensitive server information such as machine usernames and directory paths. All users are affected....

CVE-2024-37162 zsa Generates Error Messages Containing Sensitive Information

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine...

CVE-2024-37162 zsa Generates Error Messages Containing Sensitive Information

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine...

Generation of Error Message Containing Sensitive Information in zsa

Impact All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit th...

The vulnerability of the server of the Continuous Integration and Deployment application system for JetBrains TeamCity allows a hacker to trigger a service failure.

The vulnerability of the server of the Continuous Integration and Delivery Application Deployment system CI/CD JetBrains TeamCity is related to the use of incorrect authentication tokens due to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to cause...

SUSE-SU-2024:1922-1 Security update for mariadb104

This update for mariadb104 fixes the following issues: - Update to 10.4.33: - CVE-2023-22084: Fixed a bug that allowed high privileged attackers with network access via multiple protocols to compromise the server. bsc1217405...

PT-2024-7359

Name of the Vulnerable Software and Affected Versions: Cfx.re FXServer versions v9601 and earlier wpDiscuz affected versions not specified Description: The issue is related to incorrect access control and the failure to neutralize script-related HTML tags on a web page. This can allow a remote...

CVE-2024-36267

CVE-2024-36267 describes a path traversal vulnerability in the Redmine DMSF Plugin for Redmine versions prior to 3.1.4. An authenticated user could obtain or delete arbitrary files on the server within the Redmine process privileges. The root cause is a path traversal flaw (CWE-22) in the plugin....

CVE-2024-25975 Arbitrary File Overwrite

The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is...

F5 Nginx 安全漏洞

NGINX is an HTTP and reverse proxy server, email proxy server and general purpose TCP/UDP proxy server. F5 NGINX Plus and NGINX Open Source denial of service vulnerability can be exploited by unauthenticated, remote attackers to cause a denial of service...

CVE-2024-36107

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. If-Modified-Since and If-Unmodified-Since headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a...

Denial of service of Minder Server from maliciously crafted GitHub attestations

Minder is vulnerable to a denial-of-service DoS attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on th...

The vulnerability of the KUBE-APISERVER component of the Kubernetes cluster management software allows a hacker to execute containers bypassing security policies.

The vulnerability of the KUBE-APISERVER component of the Kubernetes cluster management software is related to the use of containers with the envFrom field filled in. Exploiting this vulnerability allows a malicious actor to execute containers bypassing security policies...

CVE-2024-4388

This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server...

CVE-2024-4388

CVE-2024-4388 affects the WordPress CAS plugin (versions <= 1.0.0). The vulnerability arises from a failure to validate a user-supplied path when downloading files, enabling an unauthenticated attacker to download arbitrary server files via endpoints like download.php?path=.... Several connect...

CVE-2024-4347 WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the specificDeleteCache function. This makes it possible for authenticated attackers to delete arbitrary files on the server, which can include wp-config.php files of the...

CVE-2024-5147

CVE-2024-5147 : The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to unauthenticated Local File Inclusion via the grid_style parameter in all versions up to and including 1.1.37. The vulnerability allows including and executing arbitrary PHP files on the serv...

CVE-2024-31396

Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on...

Cross-Site Scripting

Cacti is vulnerable to Cross-site Scripting. The vulnerability is due to malicious scripts being permanently stored on a target server and served to users who access a particular page, which attackers can use to execute scripts in the context of the user's browser, potentially leading to...

The vulnerability of the lighttpd web server arises from the execution of operations beyond the buffer in memory, allowing an attacker to bypass the ASLR protection mechanism and gain unauthorized access to protected information.

The vulnerability of the lighttpd web server arises from the issue of operations going beyond the buffer in memory when comparing values of the If-Modified-Since header fields. Exploiting this vulnerability allows a remote attacker to bypass the ASLR protection mechanism and gain unauthorized...