CVE-2024-0701

The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for...

The vulnerability of the Setting Handler component in the software for creating, testing, documenting, publishing, and maintaining the API interface of applications allows a perpetrator to execute arbitrary code.

The vulnerability of the Setting Handler component in software for creating, testing, documenting, publishing, and maintaining the API interface of an application relates to the copying of buffers without checking the size of input data when processing PDF files. Exploiting this vulnerability...

Unauthorized Access

gitlab:sid is vulnerable of Unauthorized Access. The vulnerability due to unauthorized user to read user email addresses through the tags feed, even if the visibility setting for the email address in the user profile is disabled. It allows an unauthorized user can get access to read sensitive...

Vault May Expose Sensitive Information When Configuring An Audit Log Device

Summary Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw . This vulnerability, CVE-2024-0831, was...

PT-2024-16789 · Openbi · Openbi

Name of the Vulnerable Software and Affected Versions: openBI versions up to 1.0.8 Description: A critical issue affects the dlfile function of the file /application/websocket/controller/Setting.php. The manipulation of the argument phpPath leads to os command injection. The attack may be initiat...

PYSEC-2024-32

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a tas...

CVE-2024-22193 vantage6 unencrypted task can be created in encrypted collaboration

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a tas...

CVE-2024-22193 vantage6 unencrypted task can be created in encrypted collaboration

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. There are no checks on whether the input is encrypted if a task is created in an encrypted collaboration. Therefore, a user may accidentally create a tas...

Apache Airflow Code Execution Vulnerability (CNVD-2024-26531)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A code execution vulnerability exists in Apache Airflow versions prior to 2.8.1,...

Postman Security Vulnerability

Postman is an API platform for developers from the US-based Postman Inc. A security vulnerability exists in Postman prior to version 10.22, which stems from arbitrary code execution via the RunAsNode and enableNodeClilnspectArguments settings...

Hyper Security Vulnerability

hyper is a fast, correct HTTP implementation of Rust in the hyperium open source. A security vulnerability exists in Hyper prior to version 3.4.1, which stems from arbitrary code execution via the RunAsNode and enableNodeClilnspectArguments settings...

PT-2024-20049 · Hyper · Hyper

Name of the Vulnerable Software and Affected Versions: Hyper versions 3.4.1 and earlier Description: The issue allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. Recommendations: For Hyper versions 3.4.1 and earlier, consider disabling...

SUSE-SU-2024:0247-1 Security update for rear23a

This update for rear23a fixes the following issues: - CVE-2024-23301: Fixed ReaR creates world-readable initrd with GRUBRESCUE=Y. bsc1218728...

Tenda AC10 安全漏洞

Tenda AC10U is a wireless router from Tenda China. The Tenda AC10U suffers from a stack buffer overflow vulnerability that is caused by incorrect boundary checking in the fromNatStaticSetting function. An attacker can exploit this vulnerability to execute arbitrary code on the system...

curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

GHSA-C3C6-F2WW-XFR2 Apache Airflow: pickle deserialization vulnerability in XComs

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

CVE-2023-50030

In the module "Jms Setting" jmssetting from Joommasters for PrestaShop, a guest can perform SQL injection in versions = 1.1.0. The method JmsSetting::getSecondImgs has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection...

RUSTSEC-2024-0007 Use-after-free when setting the locale

Version 3.0.0 introduced an AtomicStr type, that is used to store the current locale. It stores the locale as a raw pointer to an Arc. The locale can be read with AtomicStr::asstr. AtomicStr::asstr does not increment the usage counter of the Arc. If the locale is changed in one thread, another...

CVE-2023-50030

The CVE-2023-50030 issue affects the Jms Setting module for PrestaShop (Joommasters). The vulnerability is a blind SQL injection in JmsSetting::getSecondImgs() that can be triggered by a trivial HTTP request, affecting versions

CVE-2023-50030

In the module "Jms Setting" jmssetting from Joommasters for PrestaShop, a guest can perform SQL injection in versions = 1.1.0. The method JmsSetting::getSecondImgs has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection...