CVE-2024-49377

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on...

CVE-2024-49377 Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on...

CVE-2024-49377 Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on...

OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

Impact OctoPrint versions up until and including 1.10.2 are vulnerable to reflected XSS vulnerabilities through its Jinja2 template system, as this is not configured to enforce automatic escaping. This affects, among other places, the login dialog and the standalone application key confirmation...

CVE-2024-10747

A vulnerability classified as problematic was found in PHPGurukul Online Shopping Portal 2.0. This vulnerability affects unknown code of the file /admin/assets/plugins/DataTables/media/unittesting/templates/domdatath.php. The manipulation of the argument scripts leads to cross site scripting. The...

CVE-2024-10753: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been declared as problematic. This vulnerability affects unknown code of the file admin/assets/plugins/DataTables/media/unittesting/templates/domdatatwoheaders.php. The manipulation of the argument scripts leads to cross...

EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2024-2797)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain...

Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2024-2785)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-16511

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Shopping Portal version 2.0 Description A problematic vulnerability was found in the PHPGurukul Online Shopping Portal, affecting the file /admin/assets/plugins/DataTables/media/unit testing/templates/dom data th.php. The...

CVE-2023-3978 affecting package cni-plugins for versions less than 1.3.0-6

CVE-2023-3978 affecting package cni-plugins for versions less than 1.3.0-6. A patched version of the package is available...

CVE-2024-47311

Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through = 1.1.8...

CVE-2024-47311

CVE-2024-47311 relates to a Broken Access Control/missing authorization vulnerability in WordPress plugin Wheel of Life. Affected versions are

CVE-2024-47311 WordPress Wheel of Life plugin <= 1.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kraft Plugins Wheel of Life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through 1.1.8...

CVE-2024-43981: Missing Authorization

Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70...

PT-2024-32523

Name of the Vulnerable Software and Affected Versions Kraft Plugins Wheel of Life versions 1.1.8 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This enables remote attacks due to...

CVE-2024-47311: Missing Authorization

Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through = 1.1.8...

VulnCheck KEV: CVE-2023-23897

Cross-Site Request Forgery CSRF vulnerability in Ozette Plugins Simple Mobile URL Redirect plugin = 1.7.2 versions...

WordPress Broken Link Checker Plugin < 2.4.1 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:managewp:brokenlinkchecker"; if description...

GHSA-F748-7HPG-88CH vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit...

CVE-2024-10048

The Post Status Notifier Lite and Premium plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.11.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...