GHSA-8237-957H-H2C2 FileManager Deserialization of Untrusted Data vulnerability

Impact Deserialization of untrusted data from the mimes parameter could lead to remote code execution. Patches Fixed in 3.0.9 Workarounds Not needed, a composer update will solve it in a non-breaking way. References Reported responsibly Vladislav Gladkiy at Positive Technologies...

FileManager Deserialization of Untrusted Data vulnerability

Impact Deserialization of untrusted data from the mimes parameter could lead to remote code execution. Patches Fixed in 3.0.9 Workarounds Not needed, a composer update will solve it in a non-breaking way. References Reported responsibly Vladislav Gladkiy at Positive Technologies...

ICE Started Ramping Up Its Surveillance Arsenal Immediately After Donald Trump Won

US Immigration and Customs Enforcement put out a fresh call for contracts for surveillance technologies before an anticipated surge in the number of people it monitors ahead of deportation hearings...

CVE-2020-25291

creationtimestamp| type| source ---|---|--- 2024-11-13 08:04:21+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1860...

Orchid Platform has Method Exposure Vulnerability in Modals

Impact This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within t...

GHSA-CM46-GQF4-MV4F Orchid Platform has Method Exposure Vulnerability in Modals

Impact This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within t...

Axigen Mail Server 安全漏洞

Axigen Mail Server is a mail server software from Gecad Technologies. A security vulnerability exists in Axigen Mail Server version 10.5.28 and earlier, which stems from vulnerability to cross-site scripting attacks...

CVE-2024-51609

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aakif Kadiwala Emoji Shortcode emoji-shortcode allows Stored XSS.This issue affects Emoji Shortcode: from n/a through = 1.0.0...

CVE-2024-51609

CVE-2024-51609 describes a stored XSS in the WordPress plugin Emoji Shortcode (versions n/a–1.0.0) due to improper input neutralization during web page generation. Multiple connected sources confirm the vulnerability in Emoji Shortcode, with advisories indicating the issue affects versions up to ...

CVE-2024-51609 WordPress Emoji Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aakif Kadiwala Emoji Shortcode emoji-shortcode allows Stored XSS.This issue affects Emoji Shortcode: from n/a through = 1.0.0...

CVE-2024-51609 WordPress Emoji Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aakif Kadiwala Emoji Shortcode emoji-shortcode allows Stored XSS.This issue affects Emoji Shortcode: from n/a through = 1.0.0...

CVE-2024-51781

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stefan Backor Firework Shoppable Live Video firework-videos allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through = 6.3...

CVE-2024-51781 WordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stefan Backor Firework Shoppable Live Video firework-videos allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through = 6.3...

CVE-2024-51781 WordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Loop Now Technologies, Inc. Firework Shoppable Live Video allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through 6.3...

CVE-2024-51781

CVE-2024-51781 describes a reflected XSS in the Firework Shoppable Live Video WordPress plugin by Loop Now Technologies. Public details indicate improper neutralization of input during web page generation, enabling Reflected XSS affecting Firework Shoppable Live Video versions up to 6.3 (n/a to 6...

PT-2024-36: Calling arbitrary methods in Orchid Platform

The vulnerability was identified in Orchid Platform versions 8 - 14.42.x. Discovered vulnerability can be exploited by an attacker to call arbitrary methods in the Screen class, which could lead to the ability to brute force database tables and disclosure of the server's IP address. Vulnerability...

CVE-2024-10035

CVE-2024-10035 concerns BG-TEK Informatics CoslatV3 up to version 3.1069, where a Code Injection vulnerability (improper generation/controls) enables Command Injection and Privilege Escalation. Multiple connected sources confirm CoslatV3 is affected through 3.1069 and that the vendor no longer su...

PT-2024-74: Incorrect session termination in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application incorrectly terminates the session and allows attacker to reuse session credentials to obtain user information. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 04.11.2024...

PT-2024-71: Predictable format of user identifiers in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. Web application uses an unreliable algorithm for generating user account IDs. As a result, an intruder can predict existing identifiers within the application to carry out attacks targeting the authentication mechanism...

CVE-2024-51398

Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security...