CVE-2024-29033 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized access to a JupyterHub. The...

CVE-2024-28868

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external...

CVE-2024-28868 Umbraco possible user enumeration vulnerability

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external...

CVE-2024-28868 Umbraco possible user enumeration vulnerability

Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration attack. This issue was fixed in version 10.8.5. As a workaround, one may disable the native login screen by exclusively using external...

Umbraco possible user enumeration

Impact A user enumeration attack is possible. Affected versions Umbraco 10 with access to the native login screen Patches This is fixed in 10.8.5 Workarounds Disabling the native login screen, by exclusively use external logins...

CVE-2023-41877

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location ...

CVE-2023-41877 GeoServer log file path traversal vulnerability

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location ...

CVE-2023-41877 GeoServer log file path traversal vulnerability

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location ...

PT-2024-21670 · Unknown · Campcodes Complete Online Dj Booking System

Name of the Vulnerable Software and Affected Versions: Campcodes Complete Online DJ Booking System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /admin/booking-bwdates-reports-details.php. The manipulation of the fromdate...

PT-2024-20099 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.23.3 and 2.24.1 Description: A stored cross-site scripting XSS issue exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog. This...

PT-2024-2350 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.48 Description: A critical issue affects the addWifiMacFilter function of the file /goform/addWifiMacFilter, leading to a stack-based buffer overflow when the deviceMac argument is manipulated. This can be exploit...

PT-2024-2347 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 Description: The issue is related to a stack-based buffer overflow in the Tenda AC10U router's firmware, specifically affecting the function formSetFirewallCfg /goform/SetFirewallCfg and formSetDeviceName of th...

PT-2024-2352 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 Description: The issue is related to a stack-based buffer overflow in the formexeCommand function of the /goform/execCommand file. This can be exploited by manipulating the cmdinput argument, potentially allowi...

PT-2024-2443 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 Description: A critical issue has been found in the setSchedWifi function of the /goform/openSchedWifi file, which can lead to a stack-based buffer overflow when the schedStartTime argument is manipulated. This...

PT-2024-2470 · Tenda · Tenda Fh1205

Name of the Vulnerable Software and Affected Versions: Tenda FH1205 version 2.0.0.7775 Description: A critical issue affects the formSetCfm function of the /goform/setcfm file, where the manipulation of the funcpara1 argument leads to a stack-based buffer overflow. This can be exploited remotely,...

GHSA-6HH7-46R2-VF29 Server crashes on invalid Cloud Function or Cloud Job name

Impact Calling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection. Patches Added string sanitation for Cloud Function name and Cloud Job name. Workarounds Sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server...

PT-2024-21353 · Meta4 · Meta4 Hr

Name of the Vulnerable Software and Affected Versions: Meta4 HR versions 819.001.022 and earlier Description: A Cross-Site Scripting issue has been identified. The endpoint "/sitetest/english/dumpenv.jsp" is vulnerable to an XSS attack via the lang query. For example, the URL...

PT-2024-16994

Name of the Vulnerable Software and Affected Versions Devklan's Alma Blog versions 2.1.10 and earlier Description The issue is related to improper access control, which could allow an unauthenticated user to access the application's functionalities without the need for credentials. Recommendation...

PT-2024-19195 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered where cleartext passwords and hashes are exposed through log files. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and...

PT-2024-21508 · Unknown · Campcodes Online Job Finder System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown functionality of the file /admin/category/controller.php. The manipulation of the CATEGORYID argument lead...