The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos...
MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being...
The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java proces...
Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-base...
Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet.
In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to adv...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SIP packet.
AFFECTED_PRODUCTS:
Irontec Sngrep
An issue in hmq v1.5.5 allows attackers to cause a Denial of Service (DoS) via crafted requests.
Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver st...
AFFECTED_PRODUCTS:
Ethyca Fides
The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file.
A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking when copying data into a fixed-size stack buffer. An attacker can exploit this vulnerability by providing a specially crafted input to the vulne...
Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control.
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation.
AFFECTED_PRODUCTS:
Mitel Micontact Center Business
A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting (XSS) attack due to insufficient input validation.
AFFECTED_PRODUCTS:
Mitel Micontact Center Business
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
F5 Nginx Plus
... (+2)
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
F5 Nginx Plus
... (+2)
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
F5 Nginx Plus
... (+2)
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker h...
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
F5 Nginx Plus
... (+2)
Dell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
AFFECTED_PRODUCTS:
Dell Dp4400 Firmware,
Dell Dp5900 Firmware,
Dell Data Protection Advisor
An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices. A WAN attacker can make the admin interface unreachable/invisible via an unauthenticated HTTP request. Verification of the data sent by the user does not occur. The web server does not crash, but the admin interfac...
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
AFFECTED_PRODUCTS:
Telerik Report Server 2024
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity
In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+2)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+1)
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
AFFECTED_PRODUCTS:
Jetbrains TeamCity,
Jetbrains TeamCity,
Jetbrains TeamCity
... (+2)
The application implements an up- and downvote function which alters a value within a JSON file. The POST parameters are not filtered properly and therefore an arbitrary file can be overwritten. The file can be controlled by an authenticated attacker, the content cannot be controlled. It is possible...
The EmbedAI application is susceptible to security issues that enable Data Poisoning attacks. This weakness could result in the application becoming compromised, leading to unauthorized entries or data poisoning attacks, which are delivered by a CSRF vulnerability due to the absence of a secure sess...
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
AFFECTED_PRODUCTS:
Pluginus Husky Products Filter Professional For Woocommerce
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the conten...
IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264.
AFFECTED_PRODUCTS:
IBM Db2,
IBM Db2,
IBM Db2
... (+9)
Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610.
AFFECTED_PRODUCTS:
Zohocorp Manageengine Pam360
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not accept ACK of bytes we never sent
This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is consid...
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+8)
Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 (EOL) allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server.
AFFECTED_PRODUCTS:
Checkmk Checkmk,
Checkmk Checkmk,
Checkmk Checkmk
... (+1)
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with...