CVE-2024-47780 Information Disclosure in TYPO3 Page Tree

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected...

WordPress Rank Math SEO plugin <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete vulnerability

Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete vulnerability discovered by Leo in WordPress Plugin Rank Math SEO versions = 1.0.228...

CVE-2024-9161

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'updatemetadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated...

CVE-2024-9161

The CVE-2024-9161 entry affects the WordPress plugin Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (versions up to 1.0.228). The root cause is a missing capability check in the function update_metadata , which allows unauthenticated users to insert, update, or delete metadata (including u...

Tor anonymity compromised by law enforcement. Is it still safe to use?

Despite people generally considering the Tor network as an essential tool for anonymous browsing, german law enforcement agencies have managed to de-anonymize Tor users after putting surveillance on Tor servers for months. Before we go into the what the agencies did, let's take a look at some...

Microsoft Publisher 安全漏洞

Microsoft Publisher is an entry-level desktop publishing application from Microsoft USA that provides more control over page elements than Microsoft Word. A security vulnerability exists in Microsoft Publisher. An attacker could exploit the vulnerability to bypass certain features. The following...

Stable Channel Update for ChromeOS / ChromeOS Flex

Hello All, The Stable channel is being updated to 128.0.6613.133 Platform version: 15964.48.0 for ChromeOS devices and will be rolled out over the next few days. If you find new issues, please let us know one of the following ways: File a bug Visit our Chrome OS communities General: Chromebook He...

CVE-2024-45589

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters...

PT-2024-31692 · Identity Automation · Rapididentity Lts +1

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier Description: The issue allows a remote attacker to cause a denial of service via the username parameters by improperly restricting excessive...

Uncovering Hybrid Cloud Attacks Part 2 – The Attack

in this second part of the series, we’ll share the details of a real-world sophisticated, long-term attack in the cloud...

DEBIAN-CVE-2024-44943

In the Linux kernel, the following vulnerability has been resolved: mm: gup: stop abusing trygrabfolio A kernel warning was reported when pinning folio in CMA memory when launching SEV virtual machine. The splat looks like: 464.325306 WARNING: CPU: 13 PID: 6734 at mm/gup.c:1313...

PT-2024-25696 · Bpq32 · Bpq32

Name of the Vulnerable Software and Affected Versions: BPQ32 version 6.0.24.1 Description: The issue is related to an SEH-based buffer overflow in the BPQ32 HTTP Server, allowing remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request...

PT-2024-30569 · Cksource +2 · Ckeditor4 +2

Name of the Vulnerable Software and Affected Versions: CKEditor4 versions 4.22 through 4.24 Description: A theoretical issue has been identified in CKEditor4. In a highly unlikely scenario where an attacker gains control over the https://cke4.ckeditor.com domain, they could potentially execute an...

CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover

Affected Packages The issue impacts only editor instances with enabled version notifications. Please note that this feature is disabled by default in all CKEditor 4 LTS versions. Therefore, if you use CKEditor 4 LTS, it is highly unlikely that you are affected by this vulnerability. If you are...

The Slow-Burn Nightmare of the National Public Data Breach

Social Security numbers, physical addresses, and more—all available online. After months of confusion, leaked information from a background-check firm underscores the long-term risks of data breaches...

OSV-2024-861 UNKNOWN READ in chunk_free_object

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42537801 Crash type: UNKNOWN READ Crash state: chunkfreeobject gsmemorychunkunwrap gsjmemterm...

PT-2024-40866 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves functions such as chunk free object, gs memory chunk unwrap, and gs j mem...

CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

WordPress Term And Category Based Posts Widget plugin < 4.9.13 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Term And Category Based Posts Widget versions 4.9.13...

CVE-2024-6158

The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high...