ZM Ajax Login & Register Security Vulnerabilities

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, tigera-operator, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, paranoia, k8ssandra-operator, fq,...

CVE-2024-24787 vulnerabilities

Vulnerabilities for packages: bom, gitlab-pages, kube-bench, runc, hey, vertical-pod-autoscaler, bank-vaults, crossplane-provider-gcp, tekton-chains, kubernetes-dns-node-cache, docker-credential-acr-env, gobump, kubewatch, go-fips, stern, gke-gcloud-auth-plugin, chartmuseum, wireguard-go, ipfs,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: bom, gitlab-pages, kube-bench, runc, hey, vertical-pod-autoscaler, bank-vaults, crossplane-provider-gcp, tekton-chains, kubernetes-dns-node-cache, docker-credential-acr-env, gobump, kubewatch, go-fips, stern, gke-gcloud-auth-plugin, chartmuseum, wireguard-go, ipfs,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, local-static-provisioner, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, wave, paranoia,...

CVE-2023-45285 vulnerabilities

Vulnerabilities for packages: aactl, sonobuoy, gosu, hey, gobuster, k3d, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, ctop, docker-cli, aws-flb-firehose, cass-operator, gitlab-logger, gke-gcloud-auth-plugin, oras, protoc-gen-go-grpc, kind, nats, falco, dgraph, mage, petname,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-RR6R-CFGF-GC6H vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-4V7X-PQXF-CX7M vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, tigera-operator, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, paranoia, k8ssandra-operator, fq,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: bom, gitlab-pages, kube-bench, runc, hey, vertical-pod-autoscaler, bank-vaults, crossplane-provider-gcp, tekton-chains, kubernetes-dns-node-cache, docker-credential-acr-env, gobump, kubewatch, stern, gke-gcloud-auth-plugin, chartmuseum, wireguard-go, ipfs,...

CVE-2024-24790 vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, local-static-provisioner, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, wave, paranoia,...

GHSA-3Q2C-PVP5-3CQP vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, local-static-provisioner, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, wave, paranoia,...

CVE-2023-39326 vulnerabilities

Vulnerabilities for packages: aactl, sonobuoy, gosu, hey, gobuster, k3d, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, ctop, docker-cli, aws-flb-firehose, cass-operator, gitlab-logger, gke-gcloud-auth-plugin, oras, protoc-gen-go-grpc, kind, nats, falco, dgraph, mage, petname,...

GHSA-5F94-VHJQ-RPG8 vulnerabilities

Vulnerabilities for packages: aactl, sonobuoy, gosu, hey, gobuster, k3d, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, ctop, docker-cli, aws-flb-firehose, cass-operator, gitlab-logger, gke-gcloud-auth-plugin, oras, protoc-gen-go-grpc, kind, nats, falco, dgraph, mage, petname,...

GHSA-9F76-WG39-X86H vulnerabilities

Vulnerabilities for packages: aactl, sonobuoy, gosu, hey, gobuster, k3d, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, ctop, docker-cli, aws-flb-firehose, cass-operator, gitlab-logger, gke-gcloud-auth-plugin, oras, protoc-gen-go-grpc, kind, nats, falco, dgraph, mage, petname,...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: bom, gitlab-pages, kube-bench, runc, hey, vertical-pod-autoscaler, bank-vaults, crossplane-provider-gcp, tekton-chains, kubernetes-dns-node-cache, docker-credential-acr-env, gobump, kubewatch, stern, gke-gcloud-auth-plugin, chartmuseum, wireguard-go, ipfs,...

GHSA-236W-P7WF-5PH8 vulnerabilities

Vulnerabilities for packages: gitlab-pages, yq, tekton-chains, aws-flb-firehose, cass-operator, kubewatch, stern, gke-gcloud-auth-plugin, kargo, nri-prometheus, timestamp-authority, local-static-provisioner, wire-go, cilium-cli, kubernetes-csi-external-attacher, task, wave, paranoia,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: bom, yq, prometheus-operator, actions-runner-controller, kube-bench, runc, hey, aws-flb-kinesis, aws-flb-cloudwatch, vertical-pod-autoscaler, aws-flb-firehose, kubernetes-dns-node-cache, cass-operator, docker-credential-acr-env, nri-f5, kubewatch, gitlab-logger,...

CVE-2024-6265

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

CVE-2024-6265

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

CVE-2024-6265 UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uwp_sort_by’ parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied....

Metasploit Weekly Wrap-Up 06/28/2024

Unauthenticated Command Injection in Netis Router This week's Metasploit release includes an exploit module for an unauthenticated command injection vulnerability in the Netis MW5360 router which is being tracked as CVE-2024-22729. The vulnerability stems from improper handling of the password...

Security Bulletin: Vulnerability in tqdm affects IBM Process Mining CVE-2024-34062

Summary There is a vulnerability in tqdm that could allow an local authenticated attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID:...

Security Bulletin: Vulnerability in Jinja affects IBM Process Mining CVE-2024-34064

Summary There is a vulnerability in Jinja that could allow an attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability....

Security Bulletin: Vulnerability in Bouncy Castle Crypto Package For Java affects IBM Process Mining CVE-2024-30171

Summary There is a vulnerability in Bouncy Castle Crypto Package For Java that could allow an remote authenticated attacker to obtain sensitive information on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability....

Security Bulletin: Vulnerability in Bouncy Castle Crypto Package For Java affects IBM Process Mining CVE-2024-34447

Summary There is a vulnerability in Bouncy Castle Crypto Package For Java that could allow an attacker to perform a DNS poisoning attack on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Security Bulletin: Vulnerability in Netty affects IBM Process Mining CVE-2024-29025

Summary There is a vulnerability in Netty that could allow an attacker to cause a denial of service condition on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID: CVE-2024-29025 ...

Security Bulletin: Vulnerability in Bouncy Castle Crypto Package For Java affects IBM Process Mining CVE-2024-30172

Summary There is a vulnerability in Bouncy Castle Crypto Package For Java that could allow an attacker to cause a denial of service condition on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability...

Security Bulletin: Vulnerability in Pydantic affects IBM Process Mining CVE-2024-3772

Summary There is a vulnerability in Pydantic that could allow an attacker to cause a denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID: CVE-2024-3772 ...

Security Bulletin: Vulnerability in Node.js affects IBM Process Mining CVE-2024-28849

Summary There is a vulnerability in Node.js that could allow an remote authenticated attacker to obtain sensitive information on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID:...

Security Bulletin: Vulnerability in VMware Tanzu Spring Framework affects IBM Process Mining CVE-2024-22262

Summary There is a vulnerability in VMware Tanzu Spring Framework that could allow a remote attacker to conduct phishing attacks on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID:....

Security Bulletin: Vulnerability in Gunicorn affects IBM Process Mining CVE-2024-1135

Summary There is a vulnerability in Gunicorn that could allow an attacker to conduct XSS attacks on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID: CVE-2024-1135 DESCRIPTION:...

Security Bulletin: Vulnerability in Bouncy Castle Crypto Package For Java affects IBM Process Mining CVE-2024-29857

Summary There is a vulnerability in Bouncy Castle Crypto Package For Java that could allow an attacker to cause excessive CPU consumption on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details.....

Security Bulletin: Vulnerability in sqlparse affects IBM Process Mining CVE-2024-4340

Summary There is a vulnerability in sqlparse that could allow an attacker to cause a denial of service condition on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID: CVE-2024-4340 .....

Security Bulletin: Vulnerability in Pallets Werkzeug affects IBM Process Mining CVE-2024-34069

Summary There is a vulnerability in Pallets Werkzeug that could allow an attacker to gain elevated privileges on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID: CVE-2024-34069 ...

Glastonbury ticket hijack vulnerability fixed

The Glastonbury ticket website was vulnerable to a relatively simple attack that that allowed ticket theft and data leakage. What’s the issue? An attacker could scrape collaborative ticket buying websites (e.g. Reddit) to gather people’s details, use a flaw in the registration process and session.....

Combatting the Evolving SaaS Kill Chain: How to Stay Ahead of Threat Actors

The modern kill chain is eluding enterprises because they aren't protecting the infrastructure of modern business: SaaS. SaaS continues to dominate software adoption, and it accounts for the greatest share of public cloud spending. But enterprises and SMBs alike haven't revised their security...

CVE-2024-5864

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-5864

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access...

Mageia: Security Advisory (MGASA-2024-0240)

The remote host is missing an update for...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2024-1859)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the...

Ubuntu: Security Advisory (USN-6856-1)

The remote host is missing an update for...