PT-2024-36015

Name of the Vulnerable Software and Affected Versions: Skylark App for Android versions 6.2.13 and earlier Skylark App for iOS versions 6.2.13 and earlier Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing an attacker to lead the applicati...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

Microsoft Dynamics 365 Spear Phishing

The vulnerability of the Microsoft Dynamics 365 resource planning software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute a spear-phishing attack remotely...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

aef-gw (>=0.1.1, <=0.1.15), an-website (24.12.0) +15 more potentially affected by CVE-2024-53861 via pyjwt (2.10.0)

pyjwt PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aef-gw =0.1.1, =2024.4.1, =0.5.0, =0.1.14, =0.180.0, =0.0.8, =0.1.10, =1.6.1, =0.1.4, =0.1.2, =0.1.5 and more Source cves: CVE-2024-53861 Source...

VMware Aria Operations Monitoring XSS

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

VMware Aria Operations Monitoring XSS

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

VMware Aria Operations Monitoring XSS

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

webkit: malicious website may exfiltrate audio data cross-origin

A vulnerability was found in WebKit, where a remote attacker is able to exfiltrate audio data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...

webkit: maliciously crafted webpage may be able to fingerprint the user

A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions through an injection issue by persuading a victim to access a specially crafted website, enabling the attackers to fingerprint the user...

webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced

A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions due to a logic flaw by persuading a victim to access a specially crafted website, enabling attackers to circumvent the Content Security Policy enforcement...

CVE-2024-8236

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2024-8236

The CVE-2024-8236 entry concerns Elementor Website Builder for WordPress (versions

WordPress Elementor Website Builder – More than Just a Page Builder plugin <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Website Builder versions = 3.25.7...

Briefcase Module XSS

The vulnerability of the Briefcase module in the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-8236: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possibl...

WordPress plugin Elementor Website Builder cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

GitLab Arbitrary JavaScript Injection

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript code through a specially created UR...

Jitsi Meet Video Upload

The vulnerability of the video file exchange function in Jitsi Meet software for conducting video conferences is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to upload arbitrary video files remotely...