CVE-2023-48220 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the deviseinvitable gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable...

CVE-2023-48220 Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry period

Decidim is a participatory democracy framework. Starting in version 0.4.rc3 and prior to version 2.0.9 of the deviseinvitable gem, the invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. This issue creates vulnerable...

CVE-2023-47635 Decidim vulnerable to possible CSRF attack at questionnaire templates preview

Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the...

CVE-2023-47635 Decidim vulnerable to possible CSRF attack at questionnaire templates preview

Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the...

CVE-2023-47634

CVE-2023-47634 affects Decidim, a Ruby on Rails participatory democracy framework. The vulnerability is a race condition in the endorsement of resources (e.g., proposals) that can allow a user to submit more than one endorsement when multiple endorsement requests are sent in parallel. Affected ve...

CVE-2023-47634 Decidim has race condition in Endorsements

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to se...

CVE-2023-47634 Decidim has race condition in Endorsements

Decidim is a participatory democracy framework. Starting in version 0.10.0 and prior to versions 0.26.9, 0.27.5, and 0.28.0, a race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to se...

Cross-site scripting (XSS) in the dynamic file uploads

Impact The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to chang...

PT-2024-2141 · Zeek · Icsnpp - Ethercat Zeek Plugin

Name of the Vulnerable Software and Affected Versions: Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior Description: The issue is related to an out-of-bounds write in the primary analyses function for Ethercat communication packets. This...

PT-2024-18179

Name of the Vulnerable Software and Affected Versions @dfinity/identity versions prior to 1.0.1 Description The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret...

PT-2024-18021 · WordPress · Powerpack Addons For Elementor

Name of the Vulnerable Software and Affected Versions: PowerPack Addons for Elementor plugin for WordPress versions up to, and including, 2.7.15 Description: The issue is related to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget due to insufficient input sanitization a...

PT-2024-21322 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.37 Liferay DXP versions prior to 7.4 update 38 Liferay DXP versions prior to 7.3 update 11 Liferay DXP versions prior to 7.2 fix pack 20 Description: A cross-site scripting XSS issue in the Frontend...

PT-2024-15671

Name of the Vulnerable Software and Affected Versions Microsoft Clarity plugin for WordPress versions up to, and including, 0.9.3 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the edit clarity project id function. This allows unauthenticated...

Possibility to circumvent the invitation token expiry period

Impact The invites feature allows users to accept the invitation for an unlimited amount of time through the password reset functionality. When using the password reset functionality, the deviseinvitable gem always accepts the pending invitation if the user has been invited as shown in this piece...

PT-2024-15857 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.1 Description: The issue is related to Stored Cross-Site Scripting via the side image URL parameter in the Age Gate due to insufficient input sanitization...

PT-2024-20785 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.2 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 15 Description: The Calendar module in the affected software does not escape user-supplied data in the default notification emai...

PT-2024-21050 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.14 through 1.14.6 Description: The issue affects Cilium users who are using CRDs to store Cilium state and Wireguard transparent encryption. Traffic to and from the Ingress and health endpoints is not encrypted. This issue...

PT-2024-13669 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: ProjeQtOr version 11.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the checkvalidHtmlText function in the ack.php and security.php files. This enables the attacker...

PT-2024-21055 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-Mr-2402 Description: The issue allows organization owners to view the generated API KEY and USERS of other organization owners. This is achieved through the "http://192.168.26.128:8080/admin/api/users/" endpoint,...

PT-2024-7568 · Unknown · Libiec61850

Name of the Vulnerable Software and Affected Versions: libiec61850 versions 1.5.3 and earlier Description: The issue is related to the mmsServer handleDeleteNamedVariableListRequest function in the libIEC61850 library, which is associated with incorrect resource cleanup or deallocation. This can ...