UBUNTU-CVE-2024-29646

Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields...

GHSA-4HXR-28MV-Q729 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch nam...

CVE-2024-55056

A stored cross-site scripting XSS vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full name field...

CVE-2024-12024

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the emticketcategorydata and emticketindividualdata parameters in all versions up to, and including, 4.0.5.3 due to insufficient input sanitization and output escaping. Thi...

PT-2024-17388 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.1.0 through 7.4.3.38 Liferay DXP versions 7.4 GA through update 38 Liferay DXP versions 7.3 GA through update 36 Liferay DXP versions 7.2 GA through fix pack 20 Liferay DXP versions 7.1 GA through fix pack 28...

CVE-2024-55056

A stored cross-site scripting XSS vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full name field...

CVE-2024-55056

Phpgurukul Online Birth Certificate System 1.0 contains a stored XSS in /user/certificate-form.php via the full name field. The CVE-2024-55056 entry has CVSS v3.1 base score 5.4 (Medium) with AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No explicit exploit details or mitigation/vulnerable version informa...

Radare2 安全漏洞

radare2 is a set of libraries and tools for working with binaries from the radare open source. ws is a Node.js WebSocket library from the WebSockets open source. A security vulnerability exists in Radare2 version v.5.8.8, which stems from a buffer overflow that could allow an attacker to execute...

PT-2024-12668 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.4.3.87 Liferay DXP versions 7.4 GA through update 87 Liferay DXP versions 7.3 GA through update 29 Description: A cross-site scripting XSS issue in the edit Service Access Policy page allows remote...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2024-55951

Metabase is an open-source data analytics platform. For new sandboxing configurations created in 1.52.0 till 1.52.2.4, sandboxed users are able to see field filter values from other sandboxed users. This is fixed in 1.52.2.5. Users on 1.52.0 or 1.52.1 or 1.5.2 should upgrade to 1.52.2.5. There ar...

CVE-2024-55951

CVE-2024-55951 (Metabase) affects Metabase 1.52.x prior to 1.52.2.5, where sandboxed users could view field filter values from other sandboxed users. Root cause: sandbox isolation flaw in new sandboxing configurations created between 1.52.0 and 1.52.2.4. Impact: information disclosure within sand...

CVE-2024-53376

CyberPanel prior to 2.3.8 is affected by an authenticated OS command injection in the websites/submitWebsiteCreation endpoint. The root cause is input handling of the phpSelection field allowing shell metacharacters to be executed by an authenticated user, enabling arbitrary command execution wit...

Metabase 信息泄露漏洞

Metabase is an open source data analytics platform from Metabase, Inc. in the United States. An information disclosure vulnerability exists in Metabase that stems from a sandbox user being able to see field filter values from other sandbox users...

CVE-2024-11721

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.24.5. This is due to insufficient controls on the user role select field when utilizing the 'Role' field in a form. This makes it possible for unauthenticated...

PT-2024-17210 · Dynamiapps · Frontend Admin By Dynamiapps

Name of the Vulnerable Software and Affected Versions: The Frontend Admin by DynamiApps plugin for WordPress versions up to, and including, 3.24.5 Description: The issue is due to insufficient controls on the Role field in a form, allowing unauthenticated attackers to create new administrative us...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50008)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50008 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy field- spannin...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...