CVE-2024-10872

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template-post-custom-field block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

PT-2024-16605 · WordPress · Getwid

Name of the Vulnerable Software and Affected Versions: Getwid – Gutenberg Blocks plugin for WordPress versions up to, and including, 2.0.12 Description: The issue is related to Stored Cross-Site Scripting via the template-post-custom-field block due to insufficient input sanitization and output...

CVE-2024-51209

The CVE describes Cross-Site Scripting (XSS) in Anuj Kumar’s Client Management System Version 1.2. The vulnerability affects the search input fields on the admin search invoices page and the client search invoices page, allowing an attacker to inject arbitrary web script or HTML. Technical contex...

CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Page Title field of the /admin/cms/pagecontent/ endpoint due to improper user input sanitization. By submitting crafted input, an attacker can inject malicious scripts that are executed in the browse...

CVE-2024-24457

An invalid memory access when handling the ProtocolIEID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

OESA-2024-2386 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

CVE-2024-1097

CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-24459

An invalid memory access when handling the ProtocolIEID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

PT-2024-16673 · Craigk5N · Webcalendar

Name of the Vulnerable Software and Affected Versions: craigk5n/webcalendar version 1.3.0 Description: A stored cross-site scripting XSS issue exists in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of...

CVE-2024-24452

An invalid memory access when handling the ProtocolIEID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service DoS to the cellular network by repeatedly initiating connections and sending a crafted payload...

PT-2024-15883 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr/openemr version 7.0.1 Description: A stored cross-site scripting XSS issue exists in the Secure Messaging feature. An attacker can inject malicious payloads into the inputBody field, which can then be sent to other users. When the...

CVE-2024-50305 Apache Traffic Server: Valid Host field value can cause crashes

Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue...

PT-2024-9176

Name of the Vulnerable Software and Affected Versions: django-cms versions 3.11.7 through 3.11.8 django-cms versions 4.1.2 through 4.1.3 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This can be exploited by a...

CVE-2024-50572

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...

CVE-2024-50572

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...

kernel: hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field

A vulnerability was found in the Linux kernel's hwmon driver in the w83791d module where the driver performs a read operation, which can result in a NULL pointer dereference. This occurs due to an unnecessary field lm75 that is no longer needed after updates to device handling functions, the driv...

kernel: Bluetooth: hci_core: Fix possible buffer overflow

A buffer overflow flaw was found in struct hcidevinfo in the variable name8 in the Linkkux Kernel. If an attacker crafts an exploit copying more than the size of the name8, it results in a buffer overflow and a denial of service...