CVE-2024-9903

A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The...

Plug n Play Camera com.ezset.delaney 安全漏洞

Plug n Play Camera com.ezset.delaney is a camera driver from Plug n Play. A security vulnerability exists in Plug n Play Camera com.ezset.delaney version 1.2.0, which originated from an issue that allows remote attackers to obtain sensitive information through the firmware update process...

CVE-2024-9064

The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9064 Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

WordPress Elementor Inline SVG plugin <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Elementor Inline SVG versions = 1.2.0...

PT-2025-2097 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...

PT-2024-39399 · WordPress · Elementor Inline Svg

Name of the Vulnerable Software and Affected Versions: Elementor Inline SVG plugin for WordPress version 1.2.0 and earlier Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

Malicious code in ens.domains-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86e21617540f2c51cdccf6deb871c1f9e76cfaeb06a565c7265a1d7d5674e293 The OpenSSF Package Analysis project identified 'ens.domains-v2' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-46441

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...

YPay 安全漏洞

YPay is an aggregated signature-free payment system for individual webmasters by kacins personal developer. A security vulnerability exists in YPay version 1.2.0, which stems from an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code via a ZIP archive in...

CVE-2024-46441

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...

PT-2024-31989 · Ypay · Ypay

Name of the Vulnerable Software and Affected Versions: YPay version 1.2.0 Description: An arbitrary file upload vulnerability allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php, which is called from app/admin/controller/ypay/Home.php. The fi...

CVE-2024-46441

CVE-2024-46441 affects YPay 1.2.0. The vulnerability arises from an arbitrary file upload where ZIP archives are processed by themePutFile (app/common/util/Upload.php) called from app/admin/controller/ypay/Home.php, with the uncompressed file extension not being checked. Impact stated is arbitrar...

SYSCOM OMFLOW 信息泄露漏洞

SYSCOM OMFLOW is an information maintenance management system from China's SYSCOM Corporation. An information disclosure vulnerability exists in SYSCOM OMFLOW version 1.2.0 and prior versions, which originates from a remote attacker who logs into the system and can obtain the password hashes of a...

OESA-2024-2137 runc security update

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fixes: runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files...

Security Bulletin: IBM Security QRadar Offenses Forwarder App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2023-26159, CVE-2022-40023, CVE-2022-25883)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. The update addresses these issues. Vulnerability Details CVEID:CVE-2023-26159 DESCRIPTION: follow-redirects could allow a remote attacker to conduct phishing...

CVE-2024-45390

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390

The CVE-2024-45390 entry concerns the @blakeembrey/template string template library. Prior to version 1.2.0, there is a vulnerability where an attacker who can write the template name can inject and run code within the template. A patch was included in version 1.2.0. Remediation guidance from the...

AZL-48519 CVE-2024-45310 affecting package buildah for versions less than 1.41.4-2

runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers an...