Archive
14 March 2024
Vulnerabilities first published on this day (UTC), newest first.
35 results · Clear filters · Feed
-
Medium 5.5
Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination
Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.
-
Medium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 6.4
LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output es…
-
Medium 6.4
oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all versions up to, and including, 4.10.0 due to insufficient input sanitization and output escaping on…
-
Medium 5.4
Security headers not set in vantage6-UI
vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to up…
-
Medium 4.2
CORS settings overly permissive in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the a…
-
Medium 5.3
Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the …
-
Medium 4.5
IBM Integration Bus for z/OS cross-site request forgery
IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 284564.
-
Medium 6.5
Proxy-Authorization header kept across hosts in follow-redirects
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution from some register files for some Intel…
-
Medium 6.7
Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated …
-
Medium 6.7
Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authentic…
-
Medium 6.8
Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially en…
-
Medium 6.5
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to po…
-
Medium 6.1
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Inte…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.3
Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow …
-
Medium 6.5
Path traversal in GoAnywhere MFT 7.4.1 and Earlier
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.
-
Medium 5.5
A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organiz…
-
Medium 5.5
A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password.
-
Medium 5.5CVE-2024-0311 Public exploit
A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.
-
Medium 6.5
WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.
-
Medium 4.9
An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Securi…
-
Medium 5.3
An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions…
-
Medium 6.5CVE-2024-1884 EPSS 38%
Server Side Request Forgery in PaperCut NG/MF
This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.
-
Medium 6.3CVE-2024-1883 EPSS 61%
Reflected XSS in PaperCut NG/MF
This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potent…
-
Medium 4.8
Improper authorization controls in PaperCut NG/MF
This vulnerability potentially allows unauthorized enumeration of information from the embedded device APIs. An attacker must already have existing knowledge of some combination of valid usernames, device names and an internal system key. For such an attack t…
-
Medium 6.3
Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
-
Medium 6.5
The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a po…
-
Medium 6.5
Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php
-
Medium 4.3
Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unl…
-
Medium 5.9
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrato…
-
Medium 6.7
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machi…
-
Medium 5.3
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attac…
-
Medium 5.5CVE-2024-26475 Public exploit
An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of…