CVE-2024-11237 TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow

A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3vT TTV6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be...

The vulnerability of the main function in the guard.cpp module of the “Red Database” database management system allows a hacker to influence the operation of the rdbguard utility.

The vulnerability of the main function in the guard.cpp module of the “Red Database” database management system is related to the handling of the -t parameter. Exploiting this vulnerability can allow a malicious actor to cause a failure in the operation of the rdbguard utility...

AMD Management Plugin for SCCM Incorrect Default Permissions Vulnerability

Bulletin ID: AMD-SB-9005 Potential Impact: Incorrect Default Permissions Leading to Arbitrary Execution Severity: High Summary An incorrect default permissions vulnerability is identified within the AMD Management Plugin for the Microsoft® System Center Configuration Manager SCCM. The plugin is...

Command Execution Vulnerability in Changjitong T+ of Changjitong Information Technology Co.

T+ is a new Internet-based business management software. Ltd. A command execution vulnerability exists in Changjitong T+, which can be exploited by attackers to execute arbitrary commands...

The vulnerability of the rtl2832_pid_filter() function in the Realtek RTL2830 DVB-T driver for the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rtl2832pidfilter function in the drivers/media/dvb-frontends/rtl2832.c file of the Realtek RTL2830 DVB-T driver for the Linux operating system is related to memory writing beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the...

Canadian Man Arrested in Snowflake Data Extortions

A 25-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service Snowflake. Image: https://www.pomerium.com/blog/the-real-lessons-from-the-snowflake-breach On October 30, Canadian authorities arrested...

CVE-2024-9884

The T- Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9884 T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The T- Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-9884

The CVE concerns the WordPress plugin T(-) Countdown. A stored XSS flaw exists via the plugin’s tminus shortcode in all versions up to 2.4.8, caused by insufficient input sanitization and output escaping on user-supplied attributes. It affects authenticated users with contributor-level access and...

CVE-2024-9884 T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The T- Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tminus' shortcode in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin T(-) Countdown 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress T(-) Countdown plugin <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by theviper17y in WordPress Plugin T- Countdown versions = 2.4.8...

WordPress T(-) Countdown Plugin <= 2.4.8 is vulnerable to Cross Site Scripting (XSS)

Software T- Countdown Type Plugin Vulnerable versions = 2.4.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9884 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5d3f1a528362 Credits theviper17y Required privileg...

SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co.

T+ is a new Internet-based business management software. Ltd. A SQL injection vulnerability exists in Changjitong T+, which can be exploited by attackers to obtain sensitive information from the database...

China’s Salt Typhoon Hacks AT&T and Verizon, Accessing Wiretap Data: Report

China’s Salt Typhoon hacked AT&T, Verizon, and Lumen, compromising wiretap systems used in criminal investigations. The breach, linked…...

VulnCheck KEV: CVE-2020-14644

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution...

TAKENAKA ENGINEERING多款产品 安全漏洞

TAKENAKA ENGINEERING HDVR-400 and others are a digital video recorder from TAKENAKA ENGINEERING. A security vulnerability exists in various TAKENAKA ENGINEERING products, which stems from a hidden functionality issue that could allow a remote, authenticated attacker to execute arbitrary operating...

TAKENAKA ENGINEERING多款产品 安全漏洞

TAKENAKA ENGINEERING HDVR-400 and others are a digital video recorder from TAKENAKA ENGINEERING. A security vulnerability exists in various TAKENAKA ENGINEERING products that originates from a system command injection risk that could allow an authenticated, remote attacker to execute arbitrary...

Command Execution Vulnerability in T+

T+ is a new Internet-based business management software. A command execution vulnerability exists in Changjitong T+, which can be exploited by an attacker to execute arbitrary commands on the target server...

SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co. Ltd (CNVD-2024-41609)

T+ is a new Internet-based business management software. Ltd. A SQL injection vulnerability exists in Changjitong T+, which can be exploited by attackers to obtain sensitive information from the database...