6644 matches found
CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui
A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...
GHSA-QMWF-J7G7-F5JW Cross-Site Scripting in third party library mso/idna-convert
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3src sources folder in the document root...
Cross-Site Scripting in third party library mso/idna-convert
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3src sources folder in the document root...
Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025
Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficientl...
SUSE CVE-2022-38778
A flaw CVE-2022-38900 was discovered in one of Kibana's third party dependencies, that could allow an authenticated user to perform a request that crashes the Kibana server process...
Information Disclosure
typo3/cms-core is vulnerable to Information Disclosure. The vulnerability is due to Inline JavaScript settings within the RequireJS package, which allows an attacker to retrieve additional information about the installed system and third-party extensions...
Security Bulletin: IBM MaaS360 Cloud Extender Mobile Enterprise Gateway (MEG) and VPN Module affected by multiple vulnerabilities (CVE-2024-29025, CVE-2024-22262, CVE-2023-6129, CVE-2024-0727, CVE-2024-22201, CVE-2023-6237)
Summary Vulnerabilities contained within OpenSSL a 3rd party component were addressed in the IBM MaaS360 VPN Module. Vulnerabilities contained within Netty, Spring Framework and Eclipse Jetty 3rd party components were addressed in the IBM MaaS360 Mobile Enterprise Gateway MEG Module. Vulnerabilit...
Ticketmaster confirms customer data breach
Live Nation Entertainment has confirmed what everyone has been speculating on for the last week: Ticketmaster has suffered a data breach. In a filing with the SEC, Live Nation said on May 20th it identified "unauthorized activity within a third-party cloud database environment containing Company...
JetBrains TeamCity < 2022.04.7 / 2022.05.x < 2022.10.6 / 2023.x < 2023.05.6 / 2023.06.x < 2023.11.5 / 2024.x < 2024.03.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2022.04.7, or prior to 2022.10.6, or prior to 2023.05.6, or prior to 2023.11.5, or prior to 2024.03.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6,...
JetBrains TeamCity Cross-Site Scripting Vulnerability
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a cross-site...
ShinyHunters Claims Santander Bank Breach: 30M Customers’ Data for Sale
ShinyHunters claims surfaced two weeks after Santander Bank acknowledged a data breach linked to a third-party contractor involving…...
PT-2024-40385 · Requirejs · Requirejs
Name of the Vulnerable Software and Affected Versions: RequireJS affected versions not specified Description: A potential issue has been discovered in the mechanisms used for configuration of RequireJS package loading, making it susceptible to information disclosure. This could allow a potential...
After on-prem NetScaler Console (formerly ADM) upgraded to 14.1-21.60 VIP Licenses reduced warning
Duringupgrade from on-prem NetScaler Console formerly ADM version 13.0/13.1 to build 14.1-21.60 below warning is showed: Warning Text: Default NetScaler Console VIP Licenses will be reduced to 2 after the upgrade After upgrade from on-prem NetScaler Console formerly ADM version 13.0/13.1 to build...
Unspecified Vulnerability in JetBrains TeamCity
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...
DRUPAL-CONTRIB-2024-022
Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider...
CVE-2024-36367
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible...
CVE-2024-36367
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible...
CVE-2024-36365
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent...
