3909 matches found
CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization...
WordPress WPForms plugin 1.8.4-1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation vulnerability
Missing Authorization to Authenticated Subscriber+ Payment Refund and Subscription Cancellation vulnerability discovered by villu164 in WordPress Plugin Contact Form by WPForms versions 1.8.4-1.9.2.1...
CVE-2024-47146
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to obtain the devices serial number if physically adjacent and sniffing the RAW WIFI signal...
CVE-2024-47043
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address...
Ruijie Networks ReyeeOS 安全漏洞
Ruijie Networks ReyeeOS is a router from Ruijie Networks China. A security vulnerability exists in Ruijie Networks ReyeeOS version 2.206.x up to and including version 2.320.x, which stems from the use of a weak credential mechanism. An attacker can easily compute MQTT credentials by exploiting th...
PT-2024-36063
Name of the Vulnerable Software and Affected Versions: ClipBucket-v5 versions 2.0 through 5.5.1 Revision 199 Description: ClipBucket V5 provides open source video hosting with PHP. The issue exists in the upload/photo upload.php file, specifically within the decode key function. This function...
Ruijie Networks ReyeeOS 安全漏洞
Ruijie Networks ReyeeOS is a router from Ruijie Networks China. A security vulnerability exists in Ruijie Networks ReyeeOS version 2.206.x up to and including 2.320.x. An attacker can exploit this vulnerability to invalidate a legitimate user's session and launch a denial of service attack agains...
Pegasystem PEGA Platform 安全漏洞
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem, USA. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management. A security vulnerability exists...
VulnCheck KEV: CVE-2024-36111
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the...
Palantir Foundry 安全漏洞
Palantir Foundry is a business process management platform from US-based Palantir, Inc. A security vulnerability exists in Palantir Foundry versions 105.110.1 through 105.115.0, which stems from Objects Supported by Restricted Views OSV1 can be bypassed, allowing users not authorized to view such...
IBM Security Verify Access 安全漏洞
IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...
PT-2024-31662 · Unknown · Fieldserver Gateway
Name of the Vulnerable Software and Affected Versions: MSA FieldServer Gateway versions 5.0.0 through 6.5.2 Description: The issue allows cross-origin WebSocket hijacking. This means that an attacker can potentially hijack WebSocket connections from a different origin, which could lead to...
PT-2024-27094 · Zulip · Zulip
Name of the Vulnerable Software and Affected Versions: Zulip versions 8.0 through 8.3 Description: The issue is related to a memory leak vulnerability in the handling of popovers. This vulnerability occurs in the specified versions of Zulip. Recommendations: For versions 8.0 through 8.3, update t...
IBM Cloud Pak for Data 安全漏洞
IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A resource management error vulnerability exists in IBM Cloud Pak for Data versions 4.0.0 through 5.0.2, which stems from not proper...
PT-2024-33556 · Oracle · Oracle-Sidecar
Name of the Vulnerable Software and Affected Versions: oracle-sidecar versions 0.347.0 through 0.543.0 Description: The issue concerns SQL injections in multiple endpoints. An unauthenticated attacker can compromise data. Recommendations: For versions 0.347.0 through 0.543.0, upgrade the affected...
PT-2024-35040 · Unknown · Gonzalo Geraldo Adventure Bucket List
Name of the Vulnerable Software and Affected Versions: Gonzalo Geraldo Adventure Bucket List versions 1.0.0 through 1.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS, which can ...
PT-2024-34832 · Unknown · Manage User Columns
Name of the Vulnerable Software and Affected Versions: Manage User Columns versions 1.0.0 through 1.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the use...
PT-2024-33182 · Unknown · Officeweb365
Name of the Vulnerable Software and Affected Versions: OfficeWeb365 versions 7.18.23.0 through 8.6.1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "pw/savedraw" component. This enables the attacker to upload files that can lead to code execution, potentially...
UBUNTU-CVE-2024-52303
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each...
