CVE-2023-52373

Summary of CVE-2023-52373 : A permission verification flaw in the Huawei HarmonyOS/EMUI share box module's content sharing pop-up allows unauthorized file sharing. The vulnerability is described across multiple sources (NVD, Red Hat CVE page, CNVD/CNNVD entries) with a high impact on confidential...

SUSE CVE-2024-0793

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

PT-2024-14563 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue concerns a vulnerability of permission verification in the content sharing pop-up module. Successful exploitation of this issue may cause unauthorized file sharing...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: chartmuseum, flux-helm-controller, kubevela, up, zot, kubescape, eksctl, kots, helm-operator, k8sgpt, helm-push, zarf, flux-source-controller, k9s, cilium-cli, trivy...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: k9s, kubevela, zot, kots, kubescape, flux-source-controller, eksctl, helm-push, chartmuseum, trivy, k8sgpt, up, zarf, flux-helm-controller, cilium-cli, helm-operator...

PT-2024-3142 · WordPress · The Tutor Lms

Name of the Vulnerable Software and Affected Versions: The Tutor LMS – eLearning and online course solution plugin for WordPress versions up to, and including, 2.6.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the erase tutor dat...

PT-2024-20199 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 2.1.2 Apache Superset versions 3.0.0, 3.0.1 Description: Uncontrolled resource consumption can be triggered by an authenticated attacker that uploads a malicious ZIP to import database, dashboards,...

GHSA-3HV4-R2FM-H27F Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...

Email Validation Bypass And Preventing Sign Up From Email's Owner

Summary Email validation can easily be bypassed because verifyemailenabled option enable email validation at sign up only. A user changing it's email after signing up and verifying it can change it without verification in /profile. This can be used to prevent legitimate owner of the email address...

Email verification is not required after email change

Grafana is an open-source platform for monitoring and observability. A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option “verifyemailenabled” will only validate email only on sign up. This issue has been...

CVE-2024-24935

Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...

PT-2024-14112 · Unknown · My Agile Privacy

Name of the Vulnerable Software and Affected Versions: My Agile Privacy versions through 2.1.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2024-20509 · WordPress · Wp Auto Listings

Name of the Vulnerable Software and Affected Versions: Auto Listings – Car Listings & Car Dealership Plugin for WordPress versions n/a through 2.6.5 Description: The issue affects the WP Auto Listings plugin, allowing Stored XSS due to improper neutralization of input during web page generation...

PT-2024-5841

Name of the Vulnerable Software and Affected Versions WPML versions up to, and including, 4.6.12 Description The WPML plugin for WordPress is vulnerable to Remote Code Execution via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render...

Novel-Plus Code Issue Vulnerability

Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. A code issue vulnerability exists in Novel-Plus v4.3.0-RC1 and earlier versions, which stems from an arbitrary file upload vulnerability in the component com.java2nb.system.controller.SysUserController: uploadImg...

PT-2024-3147 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's image box widget due to insufficient input sanitization and output escaping. This...

CVE-2023-6234

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.: Satera LBP670C Series/Satera MF750C Series firmware...

PT-2024-17684 · Juanpao · Juanpao Jpshop

Name of the Vulnerable Software and Affected Versions: Juanpao JPShop versions up to 1.5.02 Description: A critical issue has been found, affecting the function actionUpdate of the file /api/controllers/common/UploadsController.php. The manipulation of the argument imgage leads to unrestricted...

PT-2024-17641 · Beijing Baichuo · Smart S40 Management Platform

Name of the Vulnerable Software and Affected Versions: Beijing Baichuo Smart S40 Management Platform versions up to 20240126 Description: A critical issue has been found in the Smart S40 Management Platform, affecting some unknown functionality of the file /useratte/web.php of the component Impor...

CVE-2024-0508

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table Elementor Widget in all versions up to, and including, 2.10.27 due to insufficient input sanitization and output escaping on the user supplied link URL. This makes it possib...