Adobe Experience Manager XSS

The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

OpenSearch Redirection

The vulnerability of the OpenSearch software package is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to a malicious website remotely...

EyouCMS code-related vulnerabilities

EyouCMS is an open source content management system CMS based on ThinkPHP by China's Eyou. A code issue vulnerability exists in EyouCMS version 1.5.6, which stems from an unrestricted file upload issue contained in the Website Logo Handler component...

CVE-2024-11211: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...

PT-2024-16829

Name of the Vulnerable Software and Affected Versions EyouCMS versions up to 1.6.7 Description A critical vulnerability has been found in the Website Logo Handler component of EyouCMS, allowing for unrestricted upload. The manipulation can be launched remotely. The vendor was contacted about this...

LibreNMS Alert Rules XSS

The vulnerability of the Alert Rules function in the LibreNMS network monitoring system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Microsoft Office 2016 Multiple Vulnerabilities (KB5002642)

This host is missing an important security update according to Microsoft KB5002642 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

webkitgtk: A malicious website may exfiltrate data cross-origin

A vulnerability was found in WebKit. This flaw allows a remote attacker to exfiltrate data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...

webkitgtk: Visiting a malicious website may lead to address bar spoofing

A flaw was found in WebKit. This flaw allows a remote attacker to conduct spoofing attacks by exploiting an inconsistent user interface issue. The attacker could perform address bar spoofing by tricking a victim into visiting a specially crafted website...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: Visiting a malicious website may lead to address bar spoofing CVE-2024-40866 webkitgtk: A malicious website may exfiltrate data cross-origin CVE-2024-44187 webkitgtk: webkit2gtk:...

Portal for ArcGIS XSS

The vulnerability of the Portal for ArcGIS is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks and gain full control over the application through a specially created web page...

webkit: processing malicious web content may lead to a denial of service

A flaw was found in WebKit. This issue may allow an attacker to trigger a denial of service condition by convincing a victim to visit a specially crafted website...

webkit: visiting a malicious website may lead to address bar spoofing

A flaw was found in WebKit that may allow a remote attacker to conduct spoofing attacks by exploiting an inconsistent user interface issue. By tricking a victim into visiting a specially crafted website, the attacker could perform address bar spoofing...

I transformed my English-language site avleonov.com

I transformed my English-language siteavleonov.com. While my Russian-language site avleonov.ru was intended as a mirror of my Telegram channel @avleonovrus, I wasn't sure how to move forward with the English-language site. I've been running it since 2016. For a long time, it was my main VM blog...

.NET 6.0 Update - November 12, 2024 (KB5047486)

None None...

CVE-2024-51485

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...

CVE-2024-51484

CVE-2024-51484 concerns Ampache, a web-based audio/video streaming app. The issue is in how the platform validates CSRF tokens during activation/deactivation of controllers: the token parsing/validation path does not properly secure these state-changing requests, enabling CSRF-style abuse to togg...

CVE-2024-51484

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to...

CVE-2024-51487

CVE-2024-51487 — Ampache CSRF token validation issue : Multiple connected sources confirm a vulnerability in Ampache where the token parsing/CSRF validation does not correctly handle activation/deactivation of catalog (and related directory actions). This flaw could allow an attacker to trigger C...

CVE-2024-51487 Insufficient Validation in Catalog (Activation/Deactivation) in Ampache

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...