Code injection

ONTAP versions 9.4 and higher are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information to unprivileged attackers when the object-store profiler command is being run by an administrative user...

CVE-2024-21982

CVE-2024-21982 affects NetApp ONTAP 9.4 and later. The issue is described as a vulnerability where disclosure of sensitive information could occur when the object-store profiler command is executed by an administrative user. Connected sources specify the Object-Store Profiler Command Handler as t...

PT-2024-3870 · Netapp · Ontap

Name of the Vulnerable Software and Affected Versions: ONTAP versions 9.4 and higher Description: The issue is related to the Object-Store Profiler Command Handler component in the Clustered Data ONTAP operating system for data storage systems. It involves the disclosure of sensitive information...

PT-2024-4665 · Python +9 · Python +9

Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.10.14 Python versions prior to 3.11.9 Python versions prior to 3.12.3 Python versions prior to 3.13.0a5 Description: A defect was discovered in the Python “ssl” module where there is a memory race condition with the...

Malicious code in demo-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ee37cdc93b14e892899627c645c7fd80fcc18ea968522ffa87ed65ddcb5061b The OpenSSF Package Analysis project identified 'demo-store' @ 4.99.99 npm as malicious. It is considered malicious because: - The package...

MAL-2024-51 Malicious code in demo-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ee37cdc93b14e892899627c645c7fd80fcc18ea968522ffa87ed65ddcb5061b The OpenSSF Package Analysis project identified 'demo-store' @ 4.99.99 npm as malicious. It is considered malicious because: - The package...

PT-2024-40803 · Git +1 · Libjxl

Name of the Vulnerable Software and Affected Versions: No specific software or version information is provided in the input descriptions. Description: A crash has been reported due to a global buffer overflow read of 16 bytes. The issue is related to the jxl::N AVX2::WriteToOutputStage module,...

CVE-2023-46741 CubeFS leaks magic secret key when starting Blobstore access service

CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys...

Store Locator WordPress < 1.4.15 - Admin+ Arbitrary File Deletion

Description The plugin is vulnerable to Directory Traversal, allowing authenticated attackers, with administrator access and above, to delete arbitrary files...

Workspace App for Windows appears for AllAccount although only one store is configured

Citrix Workspace App for Windows appears for all accounts although with just one store configuration. Workspace App should appear like this if only one store is configured...

WordPress Plugin Active Products Tables for WooCommerce. professional products tables for WooCommerce store Code Issues Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

ShopSite 14.0 Cross Site Scripting Vulnerability

Exploit Title: ShopSite Version: 14.0 - Stored XSS Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://www.shopsite.com/ Version: 14.0 Tested on: https://www.shopsite.com/demo.html 1 Upload poc.svg file here : https://demo.shopsite.com/cgi-bin/ssdemos/stores/alsdemo/ss/mediam.cgi...

Infinispan caches credentials in clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...

WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion

Software Store Locator WordPress Type Plugin Vulnerable versions = 1.4.14 Fixed in 1.4.15 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-50885 Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID 1c07670a139d Credits Khalid Yusuf...

PT-2023-31252 · Unknown · Book Store Management System

Name of the Vulnerable Software and Affected Versions: Book Store Management System version v1 Description: The issue allows attackers to access unauthorized pages and execute administrative functions without authenticating, due to incorrect access control. Recommendations: For Book Store...

PT-2023-31250 · Unknown · Book Store Management System

Name of the Vulnerable Software and Affected Versions: Book Store Management System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the category parameter in the "/bsms ci/index.php/category" API endpoint. This enabl...

PT-2023-31251 · Unknown · Book Store Management System

Name of the Vulnerable Software and Affected Versions: Book Store Management System version 1.0 Description: A cross-site scripting XSS issue was found in the /bsms ci/index.php/history endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the...

CVE-2023-43870

When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create...

CVE-2023-43870

The CVE-2023-43870 issue affects Paxton Net2: during installation a root certificate is installed into the trusted store, and an attacker could access the installer batch file or reverse-engineer the source to obtain the root certificate password. With the password, an attacker could issue their ...

CVE-2023-5384

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...