WordPress Widget Options plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by Webbernaut in WordPress Plugin Widget Options versions = 4.0.7...

FreeCoAP 安全漏洞

FreeCoAP is a C implementation of the CoAP server, client, and HTTP/CoAP proxy by Keith Cullen, a private developer. A security vulnerability exists in FreeCoAP version 0.7, which stems from a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code or cause a...

CVE-2024-46489

A remote command execution RCE vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL...

PT-2024-7006 · Suricata +1 · Suricata +1

Name of the Vulnerable Software and Affected Versions: Suricata versions prior to 7.0.7 Description: The issue is related to errors in checking the JA4 identifier, which provides information about the application protocol to be used between the client and server. Exploitation of this issue can...

PT-2024-6050 · Microsoft · Windows 10 +1

Name of the Vulnerable Software and Affected Versions: Windows 10 version 1507 Description: The vulnerability is related to a servicing stack issue that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507. This means that an attacker could...

CVE-2024-38693

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7...

Mobile Security Framework 安全漏洞

Mobile Security Framework MobSF is an automated all-in-one mobile application open-sourced by Mobile Security Framework. Used for penetration testing, malware analysis and security assessments, it is capable of performing both static and dynamic analysis. A security vulnerability exists in Mobile...

D-Link DI-8100 Command Injection Vulnerability

The D-Link DI-8100 is a wireless broadband router designed for small to medium-sized network environments from China's D-Link. A command injection vulnerability exists in the D-Link DI-8100 version 16.07, which stems from the fact that manipulation of parameter paths by upgradefilterasp in the fi...

August 13, 2024-KB5041951 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server 2016

None None...

PT-2024-29124 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.07 Description: The issue is a cross-site scripting vulnerability in the Secure Access administrative console. Attackers with system administrator permissions can interfere with another system...

DEBIAN-CVE-2024-39330

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, potentially allow directory traversal via certain...

SUSE CVE-2024-39614

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. getsupportedlanguagevariant was subject to a potential denial-of-service attack when used with very long strings containing specific characters...

Django Security Vulnerabilities

Django is a set of open source web application frameworks based on the Python language from the Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django version 5.0 up to and including 5.0.7, and version...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free through the handling of HTTP/3 request...

UBUNTU-CVE-2024-39329

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password...

PT-2024-4967 · Microsoft · Windows 10 +1

Name of the Vulnerable Software and Affected Versions: microsoft windows 10 1607 version Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel-Mode Driver. It is caused by a buffer overflow in memory, which can be exploited by an attacker to gain...

AZL-42928 CVE-2024-6104 affecting package prometheus for versions less than 2.37.0-14

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

Unspecified vulnerability in Tenda W9 (CNVD-2024-23316)

Tenda W9 is a wireless in-wall access point from Tenda, China. A security vulnerability exists in Tenda W9 version 1.0.0.74456, which stems from an incorrect operation of the parameter ssidIndex that can cause a stack-based buffer overflow. No details of the vulnerability are provided at this tim...

CVE-2023-37397

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain or modify sensitive information due to improper encryption of certain data. IBM X-Force ID: 259672...

PT-2024-11636 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.7 Description: The issue allows a local user to obtain sensitive information due to weaker than expected security. Recommendations: For IBM Aspera Faspex versions 5.0.0 through 5.0.7, update to a...