CVE-2024-41614

Symphony CMS versions

PT-2024-29464 · Unknown · Symphony Cms

Name of the Vulnerable Software and Affected Versions: symphonycms versions 2.7.10 and below Description: The issue is related to Cross Site Scripting XSS in the Comment component for articles. This allows for malicious scripts to be injected into the website, potentially leading to unauthorized...

CVE-2024-6704 Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing...

CVE-2024-6223

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6223 Send email only on Reply to My Comment <= 1.0.6 - Reflected XSS

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Send email only on Reply to My Comment Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Send email only on Reply to My Comment Type Plugin Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6224 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 251d7c486476 Credi...

CVE-2024-7186

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. It has been classified as critical. This affects the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. It is possible to initiate the attack remotely...

TOTOLINK A3600R 安全漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3600R suffers from a buffer overflow vulnerability that originates from improper handling of the comment parameter in the setIpQosRules function of the /cgi-bin/cstecgi.cgi file. An attacker...

PT-2024-38142 · Totolink · Totolink A3600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3600R version 4.1.2cu.5182 B20201102 Description: A critical vulnerability has been found in the setPortForwardRules function of the /cgi-bin/cstecgi.cgi file. The manipulation of the comment argument leads to a buffer overflow. Thi...

PT-2024-38148 · Totolink · Totolink A3600R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3600R version 4.1.2cu.5182 B20201102 Description: A critical issue has been found, affecting the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the comment argument leads to buffer overflow. This...

CVE-2017-15371

...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2024-1885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaini...

CVE-2024-35773

Cross-Site Request Forgery CSRF vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting XSS.This issue affects Comment Reply Email: from n/a through 1.3...

CVE-2024-35773 WordPress Comment Reply Email plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting XSS.This issue affects Comment Reply Email: from n/a through 1.3...

CVE-2024-35773 WordPress Comment Reply Email plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting XSS.This issue affects Comment Reply Email: from n/a through 1.3...

CVE-2024-35773

CVE-2024-35773 is a CSRF-to-stored XSS vulnerability in the WPJohnny zerOneIT Comment Reply Email WordPress plugin (Comment Reply Email) affecting version 1.3 and earlier. The issue enables cross-site scripting via the comment reply email flow. Public reports in multiple sources confirm the vulne...

PT-2024-26728 · Wpjohnny · Comment Reply Email

Name of the Vulnerable Software and Affected Versions: Comment Reply Email versions 1.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability and also allows Cross-Site Scripting XSS in WPJohnny, specifically in the zerOneIT Comment Reply Email...

ALPINE-CVE-2024-3596

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature...

WordPress Comment Images Reloaded plugin <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion vulnerability

Authenticated Subscriber+ Arbitrary Media Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Comment Images Reloaded versions = 2.2.1...

CVE-2024-5856

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...