PT-2024-12012 · Mythemeshop · Url Shortener

Name of the Vulnerable Software and Affected Versions: URL Shortener by MyThemeShop versions 1.0.17 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the URL Shortener by MyThemeShop, allowing potential unauthorized access...

CVE-2023-22512

This High severity DoS Denial of Service vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2024-0569

A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.83320220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to...

CVE-2024-21673

This High severity Remote Code Execution RCE vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.0 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H allows an authenticated attacker t...

Atlassian Jira Service Management Data Center and Server < 4.20.30 / 5.4.x < 5.4.15 / 5.7.x < 5.12.2 (JSDSERVER-14958)

The version of Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14958 advisory. - Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache XML Graphics Batik.This...

CVE-2023-50290

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designe...

PT-2024-1277 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 7.13.0 through 7.19.17 Confluence Data Center and Server versions 8.5.0 through 8.5.4 Confluence Data Center and Server versions 8.7.0 through 8.7.1 Description: The vulnerability is related to...

Request Smuggling org.apache.tomcat:tomcat-catalina Dependency in Crowd Data Center and Server

This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in all versions of Crowd Data Center and Server before 5.0.10, 5.1.8 and 5.2.3. This org.apache.tomcat:tomcat-catalina Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-21642 D-Tale server-side request forgery through Web uploads

D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery SSRF, allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the Load From the Web input is turned off ...

CVE-2023-46740

Summary: CVE-2023-46740 affects CubeFS before v3.3.1, where an insecure random string generator used for user accessKeys could be predicted, enabling an attacker to impersonate users and obtain higher privileges. The root cause is the use of a weak RNG for sensitive per-user keys during user crea...

CVE-2023-46739 Timing attack can leak user passwords

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS...

PT-2023-31693 · Unknown · Tms Booking For Appointments/Events Calendar – Amelia

Name of the Vulnerable Software and Affected Versions: TMS Booking for Appointments and Events Calendar – Amelia versions 1.0 through 1.0.85 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means...

PT-2023-31867 · Nautobot · Nautobot

Name of the Vulnerable Software and Affected Versions: Nautobot versions prior to 1.6.8 Nautobot versions prior to 2.1.0 Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL...

PT-2023-31781 · Unknown · Nbviewer-App

Name of the Vulnerable Software and Affected Versions: nbviewer-app aka Jupyter Notebook Viewer versions prior to 0.1.6 Description: The issue is related to the get-task-allow entitlement for release builds, which can lead to code execution due to an improperly set entitlement. The developer has...

PYSEC-2023-266

Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation.As a result, it was possible for a malicious website opened in the same browser - by the user who also had Airflow UI opened - to trigger the executio...

Mozilla Thunderbird Security Advisories (MFSA2023-53, MFSA2023-56) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2023-37544 Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8., from 2.9.0 through 2.9., from 2.10.0 through 2.10.4, from 2.11.0 throug...

PT-2023-25607 · Unknown · Marketingfire Editorial Calendar

Name of the Vulnerable Software and Affected Versions: MarketingFire Editorial Calendar versions 3.7.12 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar. Recommendations: For versions 3.7.12 and...

CVE-2023-6932

A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread. We recommend upgrading past...

PT-2023-20268 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions through 2.5.6 Description: The issue is related to a Missing Authorization vulnerability in the GamiPress plugin for WordPress, which is used for gamification purposes such as rewarding points, achievements, badges, and...