2713 matches found
CVE-2024-36680: SQL Injection Vulnerability in Facebook’s PrestaShop Module Exposes Thousands of E-commerce Sites to Credit Card Fraud
SQL Injection Exposure in Promokit.eu Threatens Facebook's PrestaShop Customers PrestaShop is a free, open-source E-commerce platform launched in 2007. Built with PHP and MySQL, it offers customizable, scalable solutions for online stores. Features include product management, inventory tracking,...
GHSA-XFX3-CR74-X3CV Exposure of secrets through system log in Jenkins Structs Plugin
Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their execution. When Structs Plugin 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may...
Malicious code in unexpected-steps (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3260 Malicious code in unexpected-steps (npm)
--- -= Per source details. Do not edit below this line.=-...
Examining the US Government’s DDoS Protection Guidance Update
In March 2024, CISA, MS-ISAC, and the FBI released updated DDoS response guidance. The document outlines key strategies and 15 steps for mitigating DDoS attacks, emphasizing the need for continuous monitoring and collaboration between government and private sectors...
CVE-2024-38359 Lightning Network Daemon Onion Bomb
The Lightning Network Daemon lnd - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd's onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version v0.17.0 to be...
Not Just Another 100% Score: MITRE ENGENIUTY ATT&CK
The latest MITRE Engenuity ATT&CK Evaluations pitted leading managed detection and response MDR services against threats modeled on the menuPass and BlackCat/AlphV adversary groups. Trend Micro achieved 100% detection across all 15 major attack steps with an 86% actionable rate for those steps—...
DEBIAN-CVE-2024-37890
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] e55e510 and backported to [email protected] 22c2876, [email protected] eeb76d3, and [email protected]...
PT-2024-27682 · Unknown · Zhimengzhe Ibarn
Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: A reflected cross-site scripting XSS issue was discovered, which can be exploited via the search parameter at the "/index.php" API endpoint. This allows for potentially malicious scripts to be execute...
Citrix Endpoint Management (aka XenMobile Server) 10.16.0 Rolling Patch 1
Package name: xms10.16.0.10108.bin For: XenMobile Server 10.16.0 Deployment type: On-premises only Replaces: None Date: June 2024 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install this and other updates to ensure that you have...
CVE-2024-32918
Permission Bypass allowing attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps...
PT-2024-24972 · Google · Android
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows attackers to bypass permissions and disable HDCP 2.2 encryption. This is achieved by not completing the HDCP Key Exchange initializatio...
Employee And Visitor Gate Pass Logging System 1.0 SQL Injection Vulnerability
Employee and Visitor Gate Pass Logging System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Exploit Title: Employee and Visitor Gate Pass Logging System - SQLi Authentication Bypass Exploit Author: Furkan Eren Tetik Vendor Homepage:...
Exploit for Deserialization of Untrusted Data in Apache Activemq
Resumen Técnico del Ataque: CVE-2023-46604 El script explota un...
USN-6802-1 postgresql-14, postgresql-15, postgresql-16 vulnerability
Lukas Fittl discovered that PostgreSQL incorrectly performed authorization in the built-in pgstatsext and pgstatsextexprs views. An unprivileged database user can use this issue to read most common values and other statistics from CREATE STATISTICS commands of other users. NOTE: This update will...
Policy data may be lost when a CVAD site is upgraded from a previous version to 2402
Please note: You can download the required file from the Citrix downloads website by visiting the following link:https://www.citrix.com/downloads/citrix-tools It's recommended that this tool be run prior to the upgrade to validate Policy compatibility. Pre-Upgrade Steps: Version CVAD 2402 Ensure...
Fuji Xerox / Fujifilm Printers Multiple Vulnerabilities (Mar 2024)
Multiple Fuji Xerox / Fujifilm printers are prone to multiple vulnerabilities in the Web Based Management. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Leafpub 1.1.9 - Stored XSS Vulnerability
Leafpub 1.1.9 - Stored Cross-Site Scripting XSS Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://github.com/Leafpub Software Link: https://github.com/Leafpub/leafpub Version: 1.1.9 Tested on: MacOS Steps to Reproduce - Please login from this address: http://localhost/leafpub/admin/login...
CVE-2022-48690
In the Linux kernel, the following vulnerability has been resolved: ice: Fix DMA mappings leak Fix leak, when user changes ring parameters. During reallocation of RX buffers, new DMA mappings are created for those buffers. New buffers with different RX ring count should substitute older ones, but...
