CVE-2024-29686

CVE-2024-29686 describes a Server-side Template Injection (SSTI) in Winter CMS v1.2.3. The vulnerability allows a remote attacker to execute arbitrary code via a crafted payload in the CMS Pages field and Plugin components. Some sources note this could be exploited by an authenticated/admin user ...

ROS-20240329-09

A vulnerability in the Privates Handler component of the X Window System X.Org Server implementation is related to an operation exceeding the buffer boundaries. operation beyond the buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker to execute arbitrary code...

PT-2024-23148 · WordPress · Wpwax Post Grid

Name of the Vulnerable Software and Affected Versions: wpWax Post Grid, Slider & Carousel Ultimate versions 1.6.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means...

Tenable Security Center Multiple Vulnerabilities (TNS-2024-06)

According to its self-reported version, the Tenable Security Center running on the remote host is . It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-06 advisory. - Security Center leverages third-party software to help provide underlying functionality. One of t...

CVE-2024-26557

Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter...

CVE-2024-26557

Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter...

CVE-2024-26557

Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter...

CLSA-2024-1711036571 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

CLSA-2024-1711036211 Update of grub2

Make this package installable only on a system having Cloudlinux signed components: grub2 and kernel...

PT-2024-22904 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Humble Hawksbill versions 2 Description: A buffer overflow issue has been found in the C++ components, allowing attackers to execute arbitrary code or cause a denial of service DoS via improper handling of arrays or strings...

CVE-2024-26104 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2024-26101 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displaye...

CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displaye...

DEBIAN-CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

UBUNTU-CVE-2024-22259

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...

The vulnerabilities of the components dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi, and seama.cgi of the D-LINK GO-RT-AC750 router’s microprogramming system allow a attacker to perform XSS attacks.

The vulnerability of the dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi, and seama.cgi components of the D-LINK GO-RT-AC750 router software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow an attacker, operating remotely, to carry ou...

MAL-2024-1091 Malicious code in udp-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0339bd7712cdbec458d820fe33388f955c5fdd4fb38e14e3fad8b2f6f4313d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in udp-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0339bd7712cdbec458d820fe33388f955c5fdd4fb38e14e3fad8b2f6f4313d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in profectus-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062a69a64c4e77b2e5cebc7f5d21c239c51139c4d420c9fbf2e616f23ec838a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...