Alertes CVE par stack

Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.

Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.

Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards...

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event...

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-e...

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the...

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the servic...

A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (...