CVE-2024-44761

An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests...

Automad Cross-site Scripting vulnerability

A persistent stored cross-site scripting XSS vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any us...

CVE-2024-40111

CVE-2024-40111 describes a stored XSS in Automad 2.0.0-alpha.4. The vulnerability lets an attacker inject JavaScript into the template body which is saved by the flat-file CMS and executed in the browser of any user visiting the page (e.g., forum). Practical impact stated across sources includes ...

CVE-2024-40111

A persistent stored cross-site scripting XSS vulnerability has been identified in Automad 2.0.0-alpha.4. This vulnerability enables an attacker to inject malicious JavaScript code into the template body. The injected code is stored within the flat file CMS and is executed in the browser of any us...

PT-2024-30509 · Elementor · Ultimate Store Kit Elementor Addons

Name of the Vulnerable Software and Affected Versions: Ultimate Store Kit Elementor Addons versions 1.6.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that ...

PT-2024-29979 · Fish Shop · Syntax-Check

Name of the Vulnerable Software and Affected Versions: fish-shop/syntax-check versions prior to v1.6.12 fish-shop/syntax-check versions prior to v2.0.0 Description: The issue is related to improper neutralization of delimiters in the pattern input, specifically the command separator ; and command...

MAL-2024-8010 Malicious code in internal-corp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40d9c3e7fab15abf1f202460c879135f1efc55a89e056e8cbf04055a4c77af39 The OpenSSF Package Analysis project identified 'internal-corp' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-28828 · Automad · Automad

Name of the Vulnerable Software and Affected Versions: Automad version 2.0.0 Description: An arbitrary file upload vulnerability in the image upload function allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin,...

Apache StreamPark 命令注入漏洞

Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. A command injection vulnerability exists in Apache StreamPark versions prior to 2.0.0 to 2.1.4, which stems from poor validation of input parameters and can be exploited by an...

Fortinet FortiAIOps Cross-Site Request Forgery Vulnerability

Fortinet FortiAIOps is a Fortinet networking solution that combines artificial intelligence and machine learning AI/ML from Fortinet. Fortinet FortiAIOps version 2.0.0 suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that...

CVE-2024-27783

Multiple cross-site request forgery CSRF weaknesses CWE-352 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests...

CVE-2024-27783

Fortinet FortiAIOps 2.0.0 is affected by a CSRF vulnerability in its web UI, allowing an unauthenticated attacker to trick a victim into making HTTP GET requests that perform arbitrary actions on behalf of a logged-in user. Root cause: insufficient validation of requests from trusted users in the...

CVE-2024-27783

Multiple cross-site request forgery CSRF weaknesses CWE-352 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests...

CVE-2024-37389 Apache NiFi: Improper Neutralization of Input in Parameter Context Description

Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client...

PT-2024-27515 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.10.0 through 1.26.0 Apache NiFi versions 2.0.0-M1 through 2.0.0-M3 Description: The vulnerability concerns a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An...

PT-2024-28238 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p8 Checkmk versions prior to 2.2.0p28 Checkmk versions prior to 2.1.0p45 Checkmk version 2.0.0 Description: The issue is related to improper neutralization of input, allowing attackers to craft malicious links...

CVE-2024-38322

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869...

PT-2024-27943 · Ibm · Ibm Storage Defender - Resiliency Service

Name of the Vulnerable Software and Affected Versions: IBM Storage Defender - Resiliency Service versions 2.0.0 through 2.0.4 Description: The issue is related to an agent username and password error response discrepancy, which exposes the product to brute force enumeration. Recommendations: For...

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on: Docker version...

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Date: 20-06-2024 Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on:...