VulnCheck KEV: CVE-2023-46808

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user...

WordPress plugin LetterPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-25011 · Lobe Chat · Lobe Chat

Name of the Vulnerable Software and Affected Versions: Lobe Chat versions prior to 0.150.6 Description: The issue is related to an unauthorized Server-Side Request Forgery SSRF vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause SSRF without logging in,...

Hoppscotch 安全漏洞

Hoppscotch is an open source Api development ecosystem. A security vulnerability exists in Hoppscotch versions prior to 0.8.0. An attacker exploited the vulnerability to cause the code to crash...

VulnCheck KEV: CVE-2013-2912

Use-after-free vulnerability in the PepperInProcessRouter::SendToHost function in content/renderer/pepper/pepperinprocessrouter.cc in the Pepper Plug-in API PPAPI in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other...

PYSEC-2024-255

Gradio before 4.20 allows credential leakage on Windows...

Ruijie Networks RG-UAC 操作系统命令注入漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which...

Merative Merge DICOM Toolkit 安全漏洞

Merative Merge DICOM Toolkit is a comprehensive API from Merative that complies with the latest DICOM standards. A security vulnerability exists in Merative Merge DICOM Toolkit C/C++ versions prior to 5.18.0 that stems from the presence of an out-of-bounds read vulnerability...

Apollo Router 安全漏洞

Apollo Router is a configurable, high-performance graphical router written in Rust. A security vulnerability exists in Apollo Router versions prior to 1.45.1, which stems from an error in the cache retrieval logic and could result in the execution of unexpected operations...

PT-2024-19774 · WordPress · The Real Media Library

Name of the Vulnerable Software and Affected Versions: The Real Media Library: Media Library Folder & File Manager plugin for WordPress versions prior to 4.22.12 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the imag...

CVE-2024-32211

An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings.cs components...

DEBIAN-CVE-2024-4059

Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML page. Chromium security severity: High...

phlex 安全漏洞

phlex is a framework for building object-oriented views in Ruby. A security vulnerability exists in Phlex versions prior to 1.10.2, which stems from maliciously generated HTML attribute names and values in Phlex that could lead to cross-site scripting...

Delinea Secret Server 安全漏洞

Delinea Secret Server is a powerful PAM in the cloud or locally from Delinea USA. A security vulnerability exists in Delinea Secret Server versions prior to 11.7.000001. An attacker exploits this vulnerability to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx...

PT-2024-19669 · WordPress · Wp Google Review Slider

Name of the Vulnerable Software and Affected Versions: WP Google Review Slider WordPress plugin versions prior to 13.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

ChangeDetection.io 安全漏洞

changedetection.io is a website change detection, monitoring and notification application by dgtlmoon individual developer. A security vulnerability exists in ChangeDetection.io versions prior to 21.045 that stems from server-side template injection using an insecure feature of Jinja2 that allows...

WordPress Plugin Import WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-15359 · Arm · Arm Cortex-M Security Extensions

Name of the Vulnerable Software and Affected Versions: Software using Cortex-M Security Extensions CMSE compiled using toolchains that implement 'Arm v8-M Security Extensions Requirements on Development Tools' prior to version 1.4 Description: The issue is related to insufficient argument checkin...

PYSEC-2024-50

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

Apache Airflow 信任管理问题漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A trust management issue vulnerability exists in Apache Airflow FTP Provider versio...