6722 matches found
CVE-2024-51738
Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairi...
CVE-2024-9020
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-51448
IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.ex...
CVE-2024-47566
A improper limitation of a pathname to a restricted directory 'path traversal' CWE-23 in Fortinet FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests...
CVE-2024-46666
An allocation of resources without limits or throttling CWE-770 vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests...
CVE-2024-20821
A vulnerability possible to reconfigure OTP allows local attackers to transit RMAReturn Merchandise Authorization mode, which disables security features. This attack needs additional privilege to control TEE...
CVE-2024-57622
An issue in the expbin component of MonetDB Server v11.49.1 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2024-11991
Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the...
CVE-2024-56213
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through = 4.0.7...
CVE-2024-12358
A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2024-53284
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect Setting functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...
CVE-2024-53743
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aezaz Shaikh Countdown Timer for Elementor countdown-timer-for-elementor allows Stored XSS.This issue affects Countdown Timer for Elementor: from n/a through = 1.3.6...
CVE-2024-11206
Unauthorized access vulnerability in the mobile application com.transsion.phoenix can lead to the leakage of user information...
CVE-2024-28730
Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to obtain sensitive information via the file upload feature of the VPN configuration module...
CVE-2024-36827
An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...
CVE-2024-56319
In Matter aka connectedhomeip or Project CHIP through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service resource exhaustion...
CVE-2024-35427
vmir e8117 was discovered to contain a segmentation violation via the exportfunction function at /src/vmirwasmparser.c...
CVE-2024-21994
StorageGRID formerly StorageGRID Webscale versions prior to 11.9 are susceptible to a Denial of Service DoS vulnerability. Successful exploit by an authenticated attacker could lead to a service crash...