Large Loss of Money? Choose Your LLM Security Solution Wisely.

...

Mozilla Firefox ESR Security Update (MFSA2024-64) - Windows

Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Thunderbird Security Update (MFSA2024-67) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2024-47257

CVE-2024-47257 affects Axis devices running AXIS OS, where handling certain Ethernet frames can cause the device to become unavailable on the network. The root cause is tied to how the vulnerable components process specific Ethernet frames, leading to network disruption. Axis has released patched...

CVE-2024-6831

Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due to a client-side-only check. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for...

GitLab 15.6 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-8177)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Inefficient Algorithmic Complexity in GitLab CVE-2024-8177 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.44 is vulnerable to Broken Authentication

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.44 Fixed in 6.45 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-10781 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 0bd21f35fe5e...

WordPress WPGYM Plugin <= 67.1.0 is vulnerable to Broken Access Control

Software WPGYM Type Plugin Vulnerable versions = 67.1.0 Fixed in 67.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9941 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 71c6636a78f1 Credits Tonn Required privilege Subscriber...

Fedora 41 : needrestart (2024-a9cf3dad4f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a9cf3dad4f advisory. Rebase to fix CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

WordPress 코드엠샵 소셜톡 Plugin <= 1.1.18 is vulnerable to Cross Site Scripting (XSS)

Software 코드엠샵 소셜톡 Type Plugin Vulnerable versions = 1.1.18 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11229 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 68c0c2cab457 Credits Peter Thaleikis Required...

Cohesive Networks VNS3 操作系统命令注入漏洞

Cohesive Networks VNS3 is a VPN Virtual Private Network solution from Cohesive Networks, Inc. Cohesive Networks VNS3 suffers from an operating system command injection vulnerability that stems from a lack of proper authentication before executing a system call using a user-supplied string. An...

WordPress WP User Manager Plugin <= 2.9.11 is vulnerable to Broken Access Control

Software WP User Manager Type Plugin Vulnerable versions = 2.9.11 Fixed in 2.9.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10216 Patch priority Low CVSS severity Low 4.3 Developer WP User Manager PSID dd84c78601e5 Credits BrokenAC ignore Required...

Fedora: Security Advisory (FEDORA-2024-b3c4e8da81)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress WPGYM Plugin <= 67.1.0 is vulnerable to Arbitrary File Upload

Software WPGYM Type Plugin Vulnerable versions = 67.1.0 Fixed in 67.2.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9942 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 58875029db47 Credits Tonn Required privilege Unauthenticated Published...

WordPress Chessgame Shizzle Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Chessgame Shizzle Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11446 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1722680fdfe8 Credits vgo0 Required...

Rockwell Automation FactoryTalk Updater Agent < 4.20.00 Privilege Escalation

The version of Rockwell Automation FactoryTalk Updater Agent installed on the remote Windows host is prior to 4.20.0. It is, therefore, affected by a privilege escalation vulnerability. For more information, consult the vendor advisory. Note that Nessus has not tested for these issues but has...

CVE-2024-53054

In the Linux kernel, the following vulnerability has been resolved: cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction A hungtask problem shown below was found: INFO: task kworker/0:0:8 blocked for more than 327 seconds. "echo 0 /proc/sys/kernel/hungtasktimeoutsecs" disables this...

CVE-2024-11277

The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVE-2024-11277

CVE-2024-11277 (404 Solution, WordPress) : The plugin is affected by a reflected Cross-Site Scripting (XSS) vulnerability via URLs in all versions up to 2.35.19. Exploitation requires a user to click a link, but does not require authentication. Root cause is insufficient input sanitization and ou...

CVE-2024-11277 404 Solution <= 2.35.19 - Reflected Cross-Site Scripting

The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...