863 matches found
ZKTeco ZKBioSecurity Code Injection Vulnerability
ZKTeco ZKBioSecurity is a web-based all-in-one platform from the Chinese company ZKTeco. A code injection vulnerability exists in ZKTeco ZKBioSecurity version 4.1.0, which stems from an incorrect operation of the parameter Department Name that can lead to cross-site scripting...
PostX < 4.1.0 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a contributor, put the below code in...
CVE-2024-34213
TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the SetPortForwardRules function...
TOTOLINK CPE CP450 安全漏洞
TOTOLINK CPE CP450 is an outdoor wireless client terminal device from China Gion Electronics TOTOLINK, which is mainly used to provide wireless broadband access services, especially for wireless network coverage in rural or remote areas. A security vulnerability exists in the TOTOLINK CPE CP450...
Fedora 40 : tpm2-tools / tpm2-tss (2024-0c9d3b51d4)
The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-0c9d3b51d4 advisory. tpm2-tss: Fixed CVE-2024-29040 tpm2-tools: Fixed CVE-2024-29038 Fixed CVE-2024-29039 Tenable has extracted the preceding description block directly...
PT-2024-22659 · Dell · Dell Openmanage Enterprise
Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions prior to 4.1.0 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which could allow a high privileged attacker with...
UBUNTU-CVE-2024-29040
This repository hosts source code implementing the Trusted Computing Group's TCG TPM2 Software Stack TSS. The JSON Quote Info returned by FapiQuote has to be deserialized by FapiVerifyQuote to the TPM Structure TPMSATTEST. For the field TPM2GENERATED magic of this structure any number can be used...
QEMU 安全漏洞
QEMU Quick Emulator is a suite of simulation processor software by Fabrice Bellard, an individual developer in France. The software is fast and cross-platform. A security vulnerability exists in QEMU, which stems from the fact that an attacker can trigger a denial of service by triggering a...
CVE-2024-32206
A stored cross-site scripting XSS vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $formdata parameter...
CVE-2024-32206
CVE-2024-32206 describes a stored XSS in WUZHICMS v4.1.0, specifically the \affiche\admin\index.php component, where a crafted payload in the $formdata parameter can cause arbitrary web script/HTML execution. The vulnerability is documented across multiple sources (NVD/Red HatOSV/CVE lists) with ...
WUZHI CMS 安全漏洞
WUZHI CMS is an open source content management system CMS based on PHP and MySQL by Five Fingers WUZHI. A security vulnerability exists in WUZHI CMS version 4.1.0, which originated from allowing an attacker to execute arbitrary code and obtain sensitive information via the index.php file...
Security Bulletin: Due to use of PostgreSQL JDBC Driver (PgJDBC), IBM Cloud Pak for AIOps is vulnerable to SQL injection
Summary PostgreSQL JDBC Driver is used by IBM Cloud Pak for AIOps for connection configuration CVE-2024-1597. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-1597 DESCRIPTION: PostgreSQL JDBC Driver PgJDBC is vulnerable to SQL injectio...
CVE-2024-28233
JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS directly affecting the former's session. More precisely, in the context of JupyterHub, this XSS could achieve full access to JupyterHub API...
CVE-2024-26481
Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter...
Kirby security breach
Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby CMS version v4.1.0 that stems from the presence of an HTML injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted payload...
Dell EMC Enterprise SONiC Input Validation Error Vulnerability
Dell EMC Enterprise SONiC is a Dell Dell enterprise solution that utilizes the SONiC open source network operating system. An input validation error vulnerability exists in Dell EMC Enterprise SONiC version 4.1.0 and version 4.0.5 and version 3.5.4 and earlier, which stems from a vulnerability...
Input validation
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7getcustomfield and CF7getcurrentuser shortcodes due to missing validation on a user controlled key. This makes it possible for...
WordPress Plugin Contact Form Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2024-0358
CVE-2024-0358 affects DeShang DSO2O (up to version 4.1.0). The root cause is an improper access control flaw in an unknown section of /install/install.php, enabling a remote attacker to manipulate access without authentication. The vulnerability is remote-exploitable and has been publicly disclos...
