BIT-KEYDB-2021-32675 DoS vulnerability in Redis

Redis is an open source, in-memory database that persists on disk. When parsing an incoming Redis Standard Protocol RESP request, Redis allocates memory according to user-specified values which determine the number of elements in the multi-bulk header and size of each element in the bulk header. ...

Hardcoded Credential Vulnerability Found in SolarWinds Web Help Desk

SolarWinds has issued patches to address a new security flaw in its Web Help Desk WHD software that could allow remote unauthenticated users to gain unauthorized access to susceptible instances. "The SolarWinds Web Help Desk WHD software is affected by a hardcoded credential vulnerability, allowi...

GO-2022-0704 Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) in github.com/goharbor/harbor

Unauthenticated users can exploit an enumeration vulnerability in Harbor CVE-2019-19030 in github.com/goharbor/harbor...

GO-2022-0491 Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go

Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go...

CVE-2024-43410

CVE-2024-43410 (Russh) : The russh Rust SSH library is vulnerable to an OOM DoS caused by allocating memory based on an untrusted 4-byte packet length. An unauthenticated client can set this length to any value, triggering large allocations before authentication and potentially exhausting the ser...

CVE-2024-43410

Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length,...

CVE-2024-6847

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot...

CVE-2024-6847

CVE-2024-6847 affects the WordPress plugin Chatbot with ChatGPT WordPress, version prior to 2.4.5. The issue is an unsanitized/uncleaned parameter being used in a SQL statement, enabling unauthenticated SQL injection when users submit messages to the chatbot. Impact is high (unauthenticated acces...

CVE-2024-6847 SmartSearch WP <= 2.4.4 - Unauthenticated SQLi

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot...

CVE-2024-6843

CVE-2024-6843 affects the WordPress Chatbot with ChatGPT plugin prior to version 2.4.5. The issue is stored XSS caused by insufficient sanitization/escaping of user inputs, enabling unauthenticated users to inject scripts that can affect admins. Red Hat’s entry reiterates the same description. Im...

PT-2024-37898 · WordPress · Chatbot With Chatgpt

Name of the Vulnerable Software and Affected Versions: The Chatbot with ChatGPT WordPress plugin versions prior to 2.4.5 Description: The issue concerns the lack of sanitization and escaping of user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

PT-2024-11926 · WordPress · Metform Elementor Contact Form Builder

Name of the Vulnerable Software and Affected Versions: The Metform Elementor Contact Form Builder for WordPress versions up to, and including, 3.2.4 Description: The issue is related to insufficient file type validation, allowing unauthenticated visitors to perform a "double extension" attack. Th...

U.S. Dept Of Defense: Improper Authentication Allows Making Appeals as Other Users

The vulnerability allowed unauthenticated users to submit appeals by manipulating HTTP responses. This undermined the security and integrity of the application, as users could perform actions reserved for logged-in users...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

CVE-2024-38530

CVE-2024-38530 affects the Open eClass platform (H5P module) via an arbitrary file upload in the module’s save.php, allowing unauthenticated uploads to the server filesystem. The underlying issue enables potential unrestricted remote code execution on the backend, since the upload location is int...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

CVE-2024-6494

The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting XSS attacks...

CVE-2024-6494

CVE-2024-6494 affects the WordPress File Upload plugin for WordPress, prior to version 4.24.8. The issue is caused by insufficient sanitization/escaping of certain parameters, which could allow unauthenticated users to trigger stored cross-site scripting (XSS). Remediation: upgrade the plugin to ...

PT-2024-28783 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber versions 2.0.15 and earlier Description: A Reflected Cross-site scripting XSS issue exists in the "/search" API endpoint, allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the keywords parameter...