CVE-2024-5149: Use of Insufficiently Random Values

The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

SUSE CVE-2020-25017

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy's setCopy header map API does not replace all existing occurences of a non-inline header...

CVE-2024-36923

In the Linux kernel, the following vulnerability has been resolved: fs/9p: fix uninitialized values during inode evict If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to...

Code Injection

symfony is vulnerable to Code Injection. The vulnerability is due to unsanitized locale values being dumped into a PHP file generated in the cache...

caddy-security Plugin OAuth Interception

The vulnerability of the caddy-security authentication plugin is related to the use of insufficiently random values. Exploiting this vulnerability allows a remote attacker to execute an OAuth hijacking attack and generate insecure, repeated authentication and API key checks in the database...

CVE-2024-36389

MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass...

CVE-2024-36389: Use of Insufficiently Random Values

MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass...

SQL Injection

terminal42/contao-tablelookupwizard is vulnerable to SQL Injection. The vulnerability is caused by insufficient sanitization of widget values before they are passed to the database, which allows an attacker to execute arbitrary SQL commands...

Koha library Command Execution

The vulnerability of the members/moremember.pl and admin/aqbudgets.pl components of the Koha library process automation software is related to the absence of a mechanism to neutralize these elements in the CSV file. Exploiting this vulnerability allows a remote attacker to execute arbitrary DDE...

CVE-2024-32877

Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. This issue lies in the mechanism for...

CVE-2024-32877 Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. This issue lies in the mechanism for...

CVE-2024-32877 Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting XSS vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 2.0.49.3. This issue lies in the mechanism for...

CVE-2024-36923

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-36923

...

CVE-2024-36923

CVE-2024-36923 is documented in a connected Nessus entry as a Linux kernel vulnerability affecting fs/9p inode eviction. Root cause: when iget fails to retrieve server information, the inode may be partially initialized; during eviction, references to uninitialized structures (e.g., fscache cooki...

CVE-2024-36923

...

CVE-2024-2253

Stored XSS in Testimonial Carousel For Elementor (WordPress) across versions

CVE-2024-2253: Improper Neutralization of Input During Web Page Generation

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-40160 · Unknown · Tablelookupwizard

Name of the Vulnerable Software and Affected Versions: tablelookupwizard versions prior to 3.3.5 tablelookupwizard versions prior to 4.0.0 Description: The issue is related to the sanitization of widget values before they are passed to the database, which could lead to an SQL injection possibilit...

Updated qtnetworkauth5 & qtnetworkauth6 packages fix security vulnerability

QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.x before 6.7.1 uses only the time to seed the PRNG, which may result in guessable values...