PT-2024-34172 · Unknown · Media Streaming Add-On

Name of the Vulnerable Software and Affected Versions: Media Streaming add-on versions prior to 500.1.1.6 Description: An authorization bypass through user-controlled key issue has been reported, potentially allowing local network attackers to gain privileges if exploited. Recommendations: For...

Media Streaming add-on 安全漏洞

Media Streaming add-on is a media streaming add-on. A security vulnerability exists in Media Streaming add-on prior to version 500.1.1.6, which stems from the inclusion of an authorization bypass vulnerability via a user control key...

WordPress Contact Form 7 Email Add on plugin <= 1.9 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Le Ngoc Anh in WordPress Plugin Contact Form 7 Email Add on versions = 1.9...

CVE-2024-10683

CVE-2024-10683 affects the WordPress plugin Contact Form 7 – PayPal & Stripe Add-on, due to unsafe use of add_query_arg/remove_query_arg without proper escaping. The issue is Reflected XSS, exploitable by unauthenticated actors who can trick a user into clicking a manipulated link, with exploitat...

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin <= 2.3.1 - Reflected Cross-Site Scripting vulnerability

WordPress Contact Form 7 - PayPal & Stripe Add-on plugin = 2.3.1 - Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.3.1...

Opera Browser Fixes Big Security Hole That Could Have Exposed Your Information

A now-patched security flaw in the Opera web browser could have enabled a malicious extension to gain unauthorized, full access to private APIs. The attack, codenamed CrossBarking , could have made it possible to conduct actions such as capturing screenshots, modifying browser settings, and accou...

CVE-2024-48021 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.3...

CVE-2024-48021

CVE-2024-48021 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Contact Form 7 – PayPal & Stripe Add-on, affecting versions up to 2.3. The issue arises from improper input neutralization during web page generation, enabling Reflected XSS. PatchStack and Red H...

Qnap QTS OS Command Injection (CVE-2023-23369)

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 2023/05/04 and...

Qnap QTS SQL Injection (CVE-2020-36195)

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedi...

CVE-2023-26691

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on...

CVE-2023-26691

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on...

CVE-2023-26687

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CS-Cart 安全漏洞

CS-Cart is an e-commerce platform from CS-Cart Inc. A security vulnerability exists in CS-Cart version 4.16.1. A remote attacker can exploit the vulnerability to obtain sensitive information via the productdata parameter in the PDF add-on...

CVE-2023-26687

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CVE-2023-26687

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the productdata parameter in the PDF Add-on...

CVE-2023-26691

CVE-2023-26691 affects CS-Cart MultiVendor 4.16.1. A Directory Traversal vulnerability in the add-on installation ZIP processing may allow remote code execution when installing a new add-on. Affected software: CS-Cart MultiVendor 4.16.1. Impact stated: remote arbitrary code execution via crafted ...

CVE-2023-26687

CVE-2023-26687 concerns CS-Cart MultiVendor 4.16.1, where a Directory Traversal flaw in the PDF Add-on allows remote attackers to obtain sensitive information via the product_data parameter. The vulnerability affects the PDF Add-on handling of that parameter, enabling access to files/directories ...

PT-2024-12108 · Cs Cart Multivendor +1 · Pdf Add-On +1

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: The issue allows remote attackers to obtain sensitive information via the product data parameter in the PDF Add-on. This is a Directory Traversal vulnerability, which can be exploited to access...

PT-2024-29967 · Openhab · Cometvisu Add-On +1

Name of the Vulnerable Software and Affected Versions: openHAB CometVisu add-on versions prior to 4.2.1 Description: The issue affects several endpoints in the CometVisu add-on of openHAB that do not require authentication, allowing unauthenticated attackers to modify or steal sensitive data. Thi...