PT-2024-34533 · Hapi Fhir · Hapi Fhir

Name of the Vulnerable Software and Affected Versions: HAPI FHIR versions prior to 6.4.0 Description: The issue allows attackers to access sensitive information or execute arbitrary code by supplying a crafted request containing malicious XML entities. This is due to an XML External Entity XXE...

PT-2024-32542 · Elementor · Elementsready Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementsReady Addons for Elementor versions n/a through 6.4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

WordPress ElementsReady Addons for Elementor plugin <= 6.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin ElementsReady Addons for Elementor versions = 6.4.0...

Tenable Security Center Security Breach

Tenable Security Center is a security center from Tenable USA. A security vulnerability exists in Tenable Security Center versions prior to 6.4.0 that originates from a vulnerability that allows an authenticated, remote attacker to view unauthorized objects and initiate scans without the required...

WordPress The Events Calendar < 6.4.0.1 - Authenticated (Contributor+) Arbitrary Events Access vulnerability

Authenticated Contributor+ Arbitrary Events Access vulnerability discovered by Scott Kingsley Clark in WordPress Plugin The Events Calendar versions 6.4.0.1...

Eclipse ThreadX RTOS 输入验证错误漏洞

Eclipse ThreadX RTOS is an advanced real-time operating system RTOS from Eclipse ThreadX designed for deeply embedded applications. A security vulnerability exists in Eclipse ThreadX versions prior to 6.4.0 that stems from a lack of array size checking in the Xtensa port, resulting in a memory...

PT-2024-13741 · Unknown · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: YetiForceCRM versions 6.4.0 and before Description: A Directory Traversal issue allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component. Recommendations: For version...

PT-2024-17934

Name of the Vulnerable Software and Affected Versions kinto-attachment versions prior to 6.4.0 Description The issue allows an attachment file of an existing record to be replaced if a user has read permission on one of the parent collections or buckets. Furthermore, if the read permission is...

CVE-2023-3640 Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space

A possible unauthorized memory access flaw was found in the Linux kernel's cpuentryarea mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize per-cpu entry area' feature was implement...

openapi-generator 代码问题漏洞

openapi-generator is a software application. It provides an open API interface. A security vulnerability exists in openapi-generator version v6.4.0 and earlier, which stems from the discovery of a vulnerability containing a server-side request forgery SSRF vulnerability via...

CVE-2021-22283

Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615 series CN 4.0 FP1, ABB Relion protection relays - 615 series IEC 5.0, ABB Relion protection relays - 615 series IEC 5.0 FP1...

CVE-2022-3002

Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...

YetiForceCrm 跨站脚本漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in YetiForceCrm versions prior to 6.4.0, which stems from an unvalidated title parameter on the LayoutEditor module in Settings and is used directly in LayoutEditor/EditField.t...

PT-2022-4372 · Yetiforce · Yetiforcecrm

Name of the Vulnerable Software and Affected Versions: yetiforcecrm versions prior to 6.4.0 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the YetiForce CRM system, which is caused by the lack of protection measures for the web page structure. This allow...

CVE-2022-2885

Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...

Mike Perham Sidekiq 安全漏洞

Mike Perham sidekiq is an application open sourced by Mike Perham. Using threads to process many jobs simultaneously in the same process, a security vulnerability exists in Mike Perham Sidekiq, which stems from the api.rb of Sidekiq before 6.4.0, where there is no limit on the number of days to...

Fortinet FortiAuthenticator 授权问题漏洞

Fortinet FortiAuthenticator, a centralized user identity management solution from Fortinet, Inc. is vulnerable to an authentication bypass vulnerability in version 6.4.0 due to improper design or implementation of the authentication module code. issue. An attacker could exploit this vulnerability...

CVE-2021-43063

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage...

Fortinet FortiWeb 资源管理错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists in versions...

CVE-2021-26111

A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device...