CVE-2024-6757

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the getimagealt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-6757: Exposure of Sensitive Information to an Unauthorized Actor

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the getimagealt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-9923

The CVE-2024-9923 vulnerability affects Team+ by TEAMPLUS TECHNOLOGY (Team+ 13.5.x) and stems from improper validation of a specific page parameter, enabling a remote attacker with administrator privileges to move arbitrary system files to the website root and access them. This is a path-traversa...

Power BI report servers XSS

The vulnerability of the Power BI report server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

Passwork password manager DOM Based XSS

The vulnerability of the password manager Passwork is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute a DOM-Based XSS attack remotely...

Passwork password manager Arbitrary JavaScript Execution

The vulnerability of the Passwork password manager is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

Passwork password manager XSS

The vulnerability of the Passwork password manager is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2024-39938 · Team+ · Team+

Name of the Vulnerable Software and Affected Versions: Team+ versions 13.5.x Description: The issue arises from the improper validation of a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access the...

GitLab XSS

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to perform cross-site scripting attacks...

cosmicdbsemantic (>=0.0.30, <=0.0.37), fiduswriter (>=3.7.0a4, <=3.7.0a5) +3 more potentially affected by CVE-2024-45231 via django (2.2.3)

django PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.30, =3.7.0a4, =0.1.1, =1.1.2, =1.1.6 - rdmo 0.14.5 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

CVE-2024-43515

creationtimestamp| type| source ---|---|--- 2024-10-08 17:54:47+00:00| seen| https://www.thezdi.com/blog/2024/10/8/the-october-2024-security-update-review...

CVE-2024-43603

creationtimestamp| type| source ---|---|--- 2024-10-08 17:54:47+00:00| seen| https://www.thezdi.com/blog/2024/10/8/the-october-2024-security-update-review 2024-10-08 21:14:29+00:00| seen| https://t.me/cvedetector/7406 2025-01-23 02:02:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2698...

.NET 8.0 Update - October 08, 2024 (KB5045993)

None None...

.NET 6.0 Update - October 08, 2024 (KB5045998)

None None...

Microsoft Dynamics 365 On-Premise XSS

The vulnerability of the Microsoft Dynamics 365 On-Premise resource planning software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service

The Mozilla Foundation's Security Advisory: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process, leading to a denial of service condition...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

Mecha CMS security vulnerabilities

Mecha CMS is a Mecha open source flat file content management system for minimalists. A security vulnerability exists in Mecha CMS version 3.0.0 that stems from vulnerability to directory traversal attacks. An attacker can construct cookies and URIs that bypass user identity checks and then pass...