459 matches found
PT-2024-27404 · Kodezen Limited · Academy Lms
Name of the Vulnerable Software and Affected Versions: Academy LMS versions 2.0.4 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, in Kodezen Limited Academy LMS. This vulnerability allows for redirection to...
CVE-2024-35748
Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4...
CVE-2024-36775
A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page...
UBUNTU-CVE-2021-47263
In the Linux kernel, the following vulnerability has been resolved: gpio: wcd934x: Fix shift-out-of-bounds error bit-mask for pins 0 to 4 is BIT0 to BIT4 however we ended up with BITn - 1 which is not right, and this was caught by below usban check UBSAN: shift-out-of-bounds in...
WBSAirback Cross-Site Request Forgery Vulnerability
WBSAirback is a next generation storage and backup system from WBSAirback. A cross-site request forgery vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to forge a malicious request to trick a victim into clicking on it to perform a sensitive operation...
Ai3 QbiBot 代码问题漏洞
Ai3 QbiBot is an intelligent customer service from the Chinese company Ai3. A code issue vulnerability exists in Ai3 QbiBot v8.0.4 and earlier versions, which stems from the presence of a file upload vulnerability. An attacker can exploit this vulnerability to upload a file containing malicious...
CVE-2023-45590
An improper control of generation of code 'code injection' in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website...
Degradation of service in h2 servers with CONTINUATION Flood
An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency. Mo...
PT-2024-18761 · Samsung · Samsung Data Store
Name of the Vulnerable Software and Affected Versions: Samsung Data Store versions prior to 5.3.00.4 Description: The issue is related to improper access control in Samsung Data Store, allowing local attackers to launch arbitrary activities with the privilege of Samsung Data Store. Recommendation...
SUSE CVE-2023-41038
Firebird is a relational database. Versions 4.0.0 through 4.0.3 and version 5.0 beta1 are vulnerable to a server crash when a user uses a specific form of SET BIND statement. Any non-privileged user with minimum access to a server may type a statement with a long CHAR length, which causes the...
lambda-middleware Security Vulnerabilities
lambda-middleware is a collection of middleware for AWS lambda functions. A security vulnerability exists in dbartholomae lambda-middleware frameguard version 1.0.4 and earlier, which stems from a security vulnerability in the component JSON Mime-Type Handler...
PT-2024-12192 · Apache · Apache Kylin
Name of the Vulnerable Software and Affected Versions: Apache Kylin versions 2.0.0 through 4.0.3 Description: The issue concerns the Server Config web interface in Apache Kylin, which displays the content of the kylin.properties file. This file may contain server-side credentials. When the Kylin...
PT-2024-11503 · WordPress · The Super Forms - Drag & Drop Form Builder
Name of the Vulnerable Software and Affected Versions: The Super Forms - Drag & Drop Form Builder WordPress plugin versions prior to 6.0.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. The bob czy panstwa sprawa zostala rozwiazana parameter is not properly escaped...
OESA-2024-1051 netdata security update
netdata is the fastest way to visualize metrics. It is a resource efficient, highly optimized system for collecting and visualizing any type of realtime time-series data, from CPU usage, disk activity, SQL queries, API calls, web site visitors, etc. netdata tries to visualize the truth of now, in...
USN-6541-1 glibc vulnerabilities
It was discovered that the GNU C Library was not properly handling certain memory operations. An attacker could possibly use this issue to cause a denial of service application crash. CVE-2023-4806, CVE-2023-4813 It was discovered that the GNU C library was not properly implementing a fix for...
CVE-2023-49052
File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component...
PT-2023-6733 · Best Practical +2 · Request Tracker +2
Name of the Vulnerable Software and Affected Versions: Best Practical Request Tracker RT versions 4.4.6 and earlier Best Practical Request Tracker RT versions 5.0.4 and earlier Description: The issue allows Information Disclosure via fake or spoofed RT email headers in an email message or a...
PT-2023-29612 · Biztechc · Biztechc Copy/Move Comments Plugin
Name of the Vulnerable Software and Affected Versions: Biztechc Copy or Move Comments plugin versions 5.0.4 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into a website, potentially...
Koha Code Issue Vulnerability
Koha is a Koha organization's system for building websites for automated library management. A security vulnerability exists in Koha Library Software version 23.0.5.04 and earlier that could allow a remote attacker to read arbitrary files via the upload-cover-image.pl component...