Floating Chat Widget < 3.1.9 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Chaty New Widget" 2...

PT-2024-21479 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue occurs when using hotplug and bringing up a 32-bit CPU. The kernel asks the firmware about the BTLB information to set up the static block TLB entries, requiring write access...

UBUNTU-CVE-2024-26666

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that...

CVE-2024-3125 Zebra ZTC GK420d Alert Setup Page settings cross site scripting

A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit h...

CVE-2024-3125

The CVE-2024-3125 entry concerns Zebra ZTC GK420d v1.0, specifically the Alert Setup Page component (settings) where the Address parameter can be manipulated to trigger cross-site scripting. It is exploitable remotely and the exploit has been disclosed. Documented impact is limited to I (integrit...

CVE-2024-3125 Zebra ZTC GK420d Alert Setup Page settings cross site scripting

A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit h...

PT-2024-23892 · Zebra · Zebra Ztc Gk420D

Name of the Vulnerable Software and Affected Versions: Zebra ZTC GK420d version 1.0 Description: A problematic issue was found in the Alert Setup Page component, specifically affecting the /settings file. The manipulation of the Address argument leads to cross-site scripting. This issue can be...

CVE-2024-3125: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit h...

Zebra ZTC GK420d 跨站脚本漏洞

The Zebra ZTC GK420d is a desktop printer from Zebra. A cross-site scripting vulnerability exists in the Zebra ZTC GK420d version 1.0, which originates from unknown code in file /settings in the component Alert Setup Page, leading to cross-site scripting via the parameter Address...

Breeze < 2.1.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape its breezeapitoken settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Ubuntu: Security Advisory (USN-6704-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2024-26648

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edpsetupreplay In edpsetupreplay, 'struct dc dc' & 'struct dmubreplay replay' was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the below:...

SUSE CVE-2021-47158

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: add error handling in sja1105setup If any of sja1105staticconfigload, sja1105clockingsetup or sja1105devlinksetup fails, we can't just return in the middle of sja1105setup or memory will leak. Add a cleanup pat...

DEBIAN-CVE-2024-26648

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edpsetupreplay In edpsetupreplay, 'struct dc dc' & 'struct dmubreplay replay' was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the below:...

UBUNTU-CVE-2024-26648

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix variable deferencing before NULL check in edpsetupreplay In edpsetupreplay, 'struct dc dc' & 'struct dmubreplay replay' was dereferenced before the pointer 'link' & 'replay' NULL check. Fixes the below:...

CVE-2021-47158

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: add error handling in sja1105setup If any of sja1105staticconfigload, sja1105clockingsetup or sja1105devlinksetup fails, we can't just return in the middle of sja1105setup or memory will leak. Add a cleanup pat...

DEBIAN-CVE-2021-47158

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: add error handling in sja1105setup If any of sja1105staticconfigload, sja1105clockingsetup or sja1105devlinksetup fails, we can't just return in the middle of sja1105setup or memory will leak. Add a cleanup pat...

NPS computy < 2.7.6 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Settings NPS Monitoring"...

Everest Backup < 2.2.5 - Admin+ Arbitrary File Upload

Description The plugin does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup PoC 1. Go to the plugin setting and in the "Restore" section...

Pentest-Muse-Cli - AI Assistant Tailored For Cybersecurity Professionals

Pentest Muse is an AI assistant tailored for cybersecurity professionals. It can help penetration testers brainstorm ideas, write payloads, analyze code, and perform reconnaissance. It can also take actions, execute command line codes, and iteratively solve complex tasks. Pentest Muse Web App In...