CVE-2024-40886 One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

CVE-2024-40886

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

Online ID Generator 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online ID Generator 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits | ...

Online Survey System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Survey System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits |...

CVE-2024-40886: Cross-Site Request Forgery (CSRF)

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

PT-2024-5772 · Cyberark · Cyberark Identity Management

Name of the Vulnerable Software and Affected Versions: CyberArk affected versions not specified Description: The issue is related to the implementation of security functions on the client-side in CyberArk Identity Management, which can be exploited by a remote attacker to elevate their privileges...

Online Banking System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Banking System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits ...

CVE-2024-6533

Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with...

kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpcremovepipedir workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel...

@qwikui-org/ui (>=0.2.2, <=0.2.3), @react-portable/core (>=0.4.0, <=0.11.2) +1 more potentially affected by CVE-2024-41677 via @builder.io/qwik (>=1.2.6, <=1.4.5)

@builder.io/qwik NPM version =1.2.6, =0.2.2, =0.4.0, =0.11.2 - not-qwik-library-test1 0.0.3 Source cves: CVE-2024-41677 Source advisory: OSV:GHSA-2RWJ-7XQ8-4GX4...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

CVE-2024-21467

Information disclosure while handling beacon probe frame during scan entry generation in client side...

CVE-2024-21467 Buffer Over-read in WLAN Host Communication

Information disclosure while handling beacon probe frame during scan entry generation in client side...

CVE-2024-21467

CVE-2024-21467 is a WLAN information-disclosure issue arising from how beacon probe frames are processed during scan entry generation on the client side. Affected component: Qualcomm WLAN/host stack; root cause: out-of-bounds beacon probe frame handling leading to information disclosure with pote...

CVE-2024-21467 Buffer Over-read in WLAN Host Communication

Information disclosure while handling beacon probe frame during scan entry generation in client side...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

PT-2024-18888 · Qualcomm · Snapdragon +122

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves information disclosure when handling beacon probe frames during scan entry generation on the client side. Recommendations: At the...

CVE-2024-6620

Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. An attacker could potentially inject malicious code which may lead to information disclosure, session theft, or client-side request forgery. Honeywell recommends updating to...

CVE-2024-6620

Honeywell PC42t, PC42tp, and PC42d printers (firmware T10.19.020016–T10.20.060398) are affected by a cross-site scripting vulnerability. The issue could allow an attacker to inject malicious script potentially leading to information disclosure, session theft, or client-side request forgery. Remed...