The vulnerability of the Passwork password manager, related to the lack of protective measures for website structures, allows attackers to carry out XSS attacks.

The vulnerability of the Passwork password manager is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the Passwork password manager, related to the lack of protective measures for website structures, allows attackers to execute DOM-Based XSS attacks.

The vulnerability of the password manager Passwork is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute a DOM-Based XSS attack remotely...

The vulnerability of Power BI report servers, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.

The vulnerability of the Power BI report server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

PT-2024-39938 · Team+ · Team+

Name of the Vulnerable Software and Affected Versions: Team+ versions 13.5.x Description: The issue arises from the improper validation of a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access the...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor, operating remotely, to perform cross-site scripting attacks...

CVE-2024-43515

creationtimestamp| type| source ---|---|--- 2024-10-08 17:54:47+00:00| seen| https://www.thezdi.com/blog/2024/10/8/the-october-2024-security-update-review...

CVE-2024-43603

creationtimestamp| type| source ---|---|--- 2024-10-08 17:54:47+00:00| seen| https://www.thezdi.com/blog/2024/10/8/the-october-2024-security-update-review 2024-10-08 21:14:29+00:00| seen| https://t.me/cvedetector/7406 2025-01-23 02:02:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2698...

.NET 6.0 Update - October 08, 2024 (KB5045998)

None None...

.NET 8.0 Update - October 08, 2024 (KB5045993)

None None...

The vulnerability of the Microsoft Dynamics 365 On-Premise resource planning software lies in the lack of security measures for the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 On-Premise resource planning software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

firefox: thunderbird: Specially crafted WebTransport requests could lead to denial of service

The Mozilla Foundation's Security Advisory: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process, leading to a denial of service condition...

The vulnerability of the graphical interface of the software platform for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows attackers to carry out cross-site scripting attacks.

The vulnerability of the graphical interface of the software platform for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to the lack of protective measures taken for the website structure. Exploiting this...

Mecha CMS 安全漏洞

Mecha CMS is a Mecha open source flat file content management system for minimalists. A security vulnerability exists in Mecha CMS version 3.0.0 that stems from vulnerability to directory traversal attacks. An attacker can construct cookies and URIs that bypass user identity checks and then pass...

CVE-2024-46446

CVE-2024-46446 affects Mecha CMS 3.0.0. A directory traversal vulnerability allows an attacker to craft cookies and URIs that bypass user identity checks, then pass parameters via POST to perform arbitrary file deletion or take over the website. The issue is rooted in inadequate validation of inp...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

CVE-2024-46446

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover...

Scam Information and Event Management

While trying to deliver malware on victims' devices and stay on them as long as they can, sometimes attackers are using quite unusual techniques. In a recent campaign starting in 2022, unknown malicious actors have been trying to mine cryptocurrency on victims' devices without user consent; they'...

CVE-2024-41987

The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a...