Arc 安全漏洞

ARC is a software package for creating and maintaining file archives. A security vulnerability exists in versions prior to Arc v1.6.0 that stems from the fact that configuration files are all readable, which could lead to a local attacker compromising information by leaking sensitive data from th...

DEBIAN-CVE-2024-27082

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 are vulnerable to stored cross-site scripting, a type of cross-site scripting where malicious scripts are permanently stored on a target server and served to users who access a particular...

WordPress Post Type Builder (PTB) plugin < 2.1.4 - Subscriber+ Arbitrary Post/Page Creation vulnerability

Subscriber+ Arbitrary Post/Page Creation vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Post Type Builder PTB versions 2.1.4...

Mbed TLS 安全漏洞

Mbed TLS is an open source, portable, easy to use, readable and flexible SSL library. A security vulnerability exists in Mbed TLS versions prior to 3.6.0, which stems from the fact that if TLS 1.2 is disabled at build time, a TLS 1.2 client may cause a denial of service by placing a server that...

nGrinder Security Vulnerabilities

nGrinder is a stress testing platform that enables you to perform script creation, test execution, monitoring and results report generator simultaneously. A security vulnerability exists in nGrinder versions prior to 3.5.9 that stems from allowing unlimited latency settings, which could result in...

AZL-38203 CVE-2024-25260 affecting package elfutils for versions less than 0.189-6

elfutils v0.189 was discovered to contain a NULL pointer dereference via the handleverdef function at readelf.c...

CVE-2024-20718 [Spain] CSRF to delete Requisition Lists at Adobe Commerce

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to trick a victim into performing actions they did not intend to do, which...

PT-2024-2833

Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.5.2645 build 20240116 QuTS hero versions prior to h5.1.5.2647 build 20240118 QuTScloud versions prior to c5.1.5.2651 Description An OS command injection vulnerability exists in QNAP operating system versions due to th...

CVE-2023-6677

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection. This issue affects Online Collection: before v.1.0.2...

CVE-2024-0833

In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installatio...

PT-2026-60948

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0 Description An issue exists where the server fails to properly parse the ID, DB, and NS headers in HTTP REST API requests that contain special characters. Unauthenticated attackers can send crafted HTTP reques...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...

Softnext Technologies Mail SQR Expert Operating System Command Injection Vulnerability

Softnext Technologies Mail SQR Expert is a comprehensive email content security management system from Softnext Technologies. Softnext Technologies Mail SQR Expert v230330 prior version suffers from an operating system command injection vulnerability, which stems from insufficient special charact...

PYSEC-2023-307

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used math.ceiltype.sizeinbytes / 32. T...

Uptime Kuma License Issue Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from Louis Lam Personal Developer. An authorization issue vulnerability exists in Uptime Kuma versions prior to 1.23.9, which stems from a lack of session token validation after a password change or after an inactivity period, whereby whe...

CVE-2023-46693

Cross Site Scripting XSS vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters...

Calendarinho Input Validation Error Vulnerability

Calendarinho is an open source calendar application for managing large teams of consultants. An input validation error vulnerability exists in versions prior to Calendarinho 15b2393, which stems from the presence of an open redirection issue that could lead to a phishing attack that could trick...

Delta Electronics InfraSuite Device Master Security Vulnerability

Delta Electronics InfraSuite Device Master is a device used to simplify and automate the monitoring of critical equipment from Delta Electronics Taiwan, China. A security vulnerability exists in Delta Electronics InfraSuite Device Master v.1.0.7 and prior versions, which originated from a...

GHSA-7PVX-4585-HQWW sequelize-typescript Prototype Pollution vulnerability

Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6...

PT-2023-7472 · Unknown · Google-Translate-Api-Browser

Name of the Vulnerable Software and Affected Versions: google-translate-api-browser versions prior to 4.1.3 Description: A Server-Side Request Forgery SSRF issue is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An...