Security Vulnerabilities - CVEs Published In April 2024
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily brute force passwords that are manually typed by the user.
CVSS Score
6.1
EPSS Score
0.002
Published
2024-04-26
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.
CVSS Score
4.3
EPSS Score
0.003
Published
2024-04-26
ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.
CVSS Score
6.5
EPSS Score
0.001
Published
2024-04-26
Portainer before 2.20.0 allows redirects when the target is not index.yaml.
CVSS Score
9.1
EPSS Score
0.001
Published
2024-04-26
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
CVSS Score
4.7
EPSS Score
0.001
Published
2024-04-25
Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration.
CVSS Score
7.1
EPSS Score
0.001
Published
2024-04-25
File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file.
CVSS Score
6.3
EPSS Score
0.001
Published
2024-04-25
Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.
CVSS Score
9.1
EPSS Score
0.001
Published
2024-04-25
Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.
CVSS Score
9.1
EPSS Score
0.001
Published
2024-04-25
ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.
CVSS Score
9.8
EPSS Score
0.001
Published
2024-04-25