Privilege Escalation in Kubernetes

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise...

CVE-2024-32078 WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212...

CVE-2024-32078 WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212...

PT-2024-24343 · Mealie · Mealie

Name of the Vulnerable Software and Affected Versions: Mealie versions prior to 1.4.0 Description: The issue concerns the scrape image function, which retrieves an image based on a user-provided URL without validating if the URL points to an external location and lacks enforced rate limiting. The...

GHSA-M6Q9-P373-G5Q8 Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's...

CVE-2024-1249

CVE-2024-1249 affects Keycloak’s OIDC component, specifically the checkLoginIframe path, where unvalidated cross-origin messages are accepted. The root cause is a lack of origin validation for incoming cross-origin communications, enabling an adversary to coordinate many requests and potentially ...

CVE-2024-1249 Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

CVE-2024-1249

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

CVE-2024-3572

CVE-2024-3572 – Summary The Scrapy project (scrapy/scrapy) is vulnerable to XML External Entity (XXE) attacks due to parsing untrusted XML with lxml.etree.fromstring without proper validation. The underlying issue lies in how XML is parsed, enabling a remote attacker to cause denial of service, a...

CVE-2024-1849

The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL...

Scrapy 安全漏洞

Scrapy is a free and open source web crawler framework written in Python. A security vulnerability exists in Scrapy that stems from the use of lxml.etree.fromstring to parse untrusted XML data without proper validation, allowing an attacker to perform a denial-of-service attack, access a local...

PHPGurukul Student Record System SQL注入漏洞

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the id/password parameter of the file /login.php. An attacker can exploit this vulnerability to...

WordPress WP Customer Reviews Plugin < 3.7.1 is vulnerable to Unvalidated Redirects and Forwards

Software WP Customer Reviews Type Plugin Vulnerable versions 3.7.1 Fixed in 3.7.1 OWASP Top 10 A3: Injection Classification Unvalidated Redirects and Forwards CVE CVE-2024-1849 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 694993a46a33 Credits Dmitrii Ignatyev Required...

WordPress Plugin WP Customer Reviews 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability

Unvalidated Redirects and Forwards vulnerability discovered by Byeongjun Jo Patchstack Alliance in WordPress Plugin FV Flowplayer Video Player versions = 7.5.44.7212...

WordPress FV Flowplayer Video Player Plugin <= 7.5.44.7212 is vulnerable to Unvalidated Redirects and Forwards

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.44.7212 Fixed in 7.5.45.7212 OWASP Top 10 A3: Injection Classification Unvalidated Redirects and Forwards CVE CVE-2024-32078 Patch priority Low CVSS severity Low 4.1 Developer Claim ownership PSID cc8148fa1127 Credits...

CVE-2023-6385

The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs...