CVE-2024-47226

A stored cross-site scripting XSS vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties...

CVE-2024-47226

A stored cross-site scripting XSS vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties...

CVE-2024-47226

NetBox 4.1.0 is affected by a stored XSS in the Admin panel’s Configuration History feature, via the /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the Top banner field. The issue’s validity is debated by third parties, arguing the banner is...

CVE-2024-43413

Xibo CMS prior to 4.1.0 is affected by an XSS vulnerability in the DataSet feature: allowing authorized users to execute JavaScript by crafting a DataSet HTML column that contains JavaScript. The JS runs on the Data Entry page and on any Layouts referencing that DataSet. In version 4.1.0 this beh...

Xibo CMS 安全漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo CMS versions prior to 4.1.0, which stems from vulnerability to a cross-site scripting attack that allows an authorized user to execute arbitrary JavaScript via the file preview...

Xibo CMS 安全漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo CMS versions prior to 4.1.0, which stems from vulnerability to a cross-site scripting attack that allows authorized users to execute JavaScript via the DataSet function...

CVE-2024-39775

in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read...

PT-2024-28669 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions 4.1.0 and prior Description: The issue allows a remote attacker to cause an information leak through an out-of-bounds read. Recommendations: For versions 4.1.0 and prior, update to a newer version to mitigate the risk of...

PT-2024-22233 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.1.0 Description: The issue allows a local attacker to cause a crash through an integer overflow. Recommendations: For OpenHarmony versions prior to 4.1.0, update to the latest version as outlined in the securit...

CVE-2024-8023

CVE-2024-8023 describes a critical SQL injection in chillzhuang SpringBlade 4.1.0. The vulnerability affects an unknown function of the endpoint /api/blade-system/menu/list?updatexml, with remote exploitation possible. Public exploitation is noted, and vendor contact occurred without response. Co...

CVE-2024-8023 chillzhuang SpringBlade list sql injection

A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

SpringBlade SQL注入漏洞

SpringBlade is a microservices development platform from Blade, a Chinese company. A SQL injection vulnerability exists in SpringBlade version 4.1.0, which originates from /api/blade-system/menu/list?updatexml contains a SQL injection vulnerability...

GHSA-J4R7-P9FP-W3F3 Spring Cloud Function Framework vulnerable to Denial of Service

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Sprin...

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's TCG TPM2 Software Stack TSS. The JSON Quote Info returned by FapiQuote has to be deserialized by FapiVerifyQuote to the TPM Structure TPMSATTEST. For the field TPM2GENERATED magic of this structure any number can be used...

AZL-42978 CVE-2024-29040 affecting package tpm2-tss for versions less than 4.0.2-1

This repository hosts source code implementing the Trusted Computing Group's TCG TPM2 Software Stack TSS. The JSON Quote Info returned by FapiQuote has to be deserialized by FapiVerifyQuote to the TPM Structure TPMSATTEST. For the field TPM2GENERATED magic of this structure any number can be used...

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's TCG TPM2 Software Stack TSS. The JSON Quote Info returned by FapiQuote has to be deserialized by FapiVerifyQuote to the TPM Structure TPMSATTEST. For the field TPM2GENERATED magic of this structure any number can be used...

CVE-2024-27322 affecting package R for versions less than 4.1.0-5

CVE-2024-27322 affecting package R for versions less than 4.1.0-5. A patched version of the package is available...

PT-2024-30272 · Unknown · Post Grid Gutenberg Blocks/Wordpress Blog Plugin

Name of the Vulnerable Software and Affected Versions: The Post Grid Gutenberg Blocks and WordPress Blog Plugin version prior to 4.1.0 Description: The issue concerns a lack of validation and escaping of certain block options, which could allow users with the contributor role and above to perform...

WordPress plugin Post Grid Gutenberg Blocks and WordPress Blog security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the WordPre...

CVE-2024-6006

CVE-2024-6006 affects ZKTeco ZKBio CVSecurity V5000 4.1.0, specifically the Summer Schedule Handler’s Schedule Name argument. Exploitation allows cross-site scripting and may be triggered remotely; the exploit has been disclosed. The vendor notes ZKBio Security V5000 was withdrawn and recommends ...