DEBIAN-CVE-2024-46958

In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files between the server and client may become world writable or world readable. This is fixed in 3.13.4...

PT-2024-31003 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7 macOS Sonoma versions prior to 14.7 macOS Sequoia versions prior to 15 Description: A library injection issue was addressed with additional restrictions. This issue allows an app to potentially modify protected...

OpenDaylight 安全漏洞

OpenDaylight ODL is an open source SDN controller from OpenDaylight Open Source. A security vulnerability exists in OpenDaylight Model-Driven Service Abstraction Layer MD-SAL version 13.0.1 and earlier, which stems from the fact that controllers with the follower role can configure flow entries i...

WordPress plugin WP Meta SEO 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-31646 · Joomunited · Wp Meta Seo

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Meta SEO versions 4.5.13 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS. Recommendations: For...

CVE-2024-45111

creationtimestamp| type| source ---|---|--- 2024-09-13 11:41:25+00:00| seen| https://t.me/cvedetector/5575...

CVE-2024-6656

Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable.This issue affects Cockpit Software: before v2.13...

TNB Mobile Solutions Cockpit 安全漏洞

TNB Mobile Solutions Cockpit is a mobile solution management platform from TNB Mobile Solutions. A security vulnerability exists in TNB Mobile Solutions Cockpit versions prior to v2.13 that stems from the presence of a hard-coded credentials issue...

CLSA-2024-1726163202 expat: Fix of 3 CVEs

The release version was raised because it corresponds to version 13 - CVE-2024-45490: reject negative len for XMLParseBuffer to prevent improper restriction of XML External Entity Reference - CVE-2024-45491: prevent integer overflow in dtdCopy - CVE-2024-45492: prevent integer overflow in...

CVE-2024-44720

SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component adminsafe.php...

Joplin 跨站脚本漏洞

Joplin is an open source note-taking and to-do list application from the individual developer Laurent Cozic. A cross-site scripting vulnerability exists in Joplin version 3.0.13 that stems from processing HTML content without properly escaping or handling symbols, which allows cross-site scriptin...

PT-2024-31221 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.1 Description: A Server-Side Request Forgery SSRF issue was discovered in SeaCMS. This issue occurs via the url parameter at the "/admin reslib.php" API endpoint. Recommendations: For SeaCMS version 13.1, as a temporary...

puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...

puppet-foreman: An authentication bypass vulnerability exists in Foreman

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing...

CVE-2024-34637

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-38811

VMware Fusion 13.x before 13.6 contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application...

CVE-2024-44683

Seacms v13 is vulnerable to Cross Site Scripting XSS via admin-video.php...

SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version v13, which originates from a cross-site scripting vulnerability contained...

PT-2024-31303 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: Seacms version 13.1 Description: The issue allows attackers to control IP parameters written to the data/admin/ip.php file when the action is set, potentially resulting in arbitrary command execution. This occurs due to a vulnerability in the...

WordPress GiveWP plugin <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update vulnerability

Missing Authorization to Unauthenticated Event Settings Update vulnerability discovered by villu164 in WordPress Plugin GiveWP versions = 3.13.0...