CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2024-11942

A File Manipulation vulnerability exists in Drupal Core (versions 10.0.0 before 10.2.10) due to a bug in the CKEditor 5 module that incorrectly handles image uploads. Under specific uncommon site configurations, an attacker could exploit this to move the entire webroot to a different location on ...

CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2024-11942

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2024-11942: Detection of Error Condition Without Action

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

Cisco NX-OS Improper Input Validation (CVE-2012-4122)

The CLI parser in Cisco NX-OS allows local users to bypass intended access restrictions, and overwrite or create arbitrary files, via shell output redirection, aka Bug IDs CSCts56672 and CSCts56669. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot f...

Zyxel Multiple Firewalls Path Traversal Vulnerability

Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL...

CVE-2024-11998

A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forneccedor.chp. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2024-11971

A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. T...

CVE-2024-11971 Guizhou Xiaoma Technology jpress Avatar upload cross site scripting

A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. T...

CVE-2024-11971

CVE-2024-11971 affects Guizhou Xiaoma Technology jpress 5.1.2. The vulnerability resides in the Avatar Handler’s file upload endpoint at /commons/attachment/upload, where manipulating the files argument leads to cross-site scripting. The issue can be triggered remotely and exploits have been disc...

CVE-2024-11744 1000 Projects Portfolio Management System MCA register.php sql injection

A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely...

CVE-2024-11675

A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /backend/admin/hisadminregisterpatient.php of the component Add Patient Details Page. The manipulation of the argument...

CVE-2024-11674 CodeAstro Hospital Management System his_doc_update-account.php unrestricted upload

A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an unknown function of the file /backend/doc/hisdocupdate-account.php. The manipulation of the argument docdpic leads to unrestricted upload. It is possible to launch the attack...

CVE-2024-48862

CVE-2024-48862 affects QNAP’s QuLog Center. A link-following vulnerability could allow remote attackers to traverse the file system and read or overwrite files. Affected versions are prior to 1.7.0.831 and prior to 1.8.0.888; fixed in 1.7.0.831+ and 1.8.0.888+. CVSS metrics indicate high impact (...

CVE-2024-11587

CVE-2024-11587 affects idcCMS 1.60, specifically the GetCityOptionJs function in /inc/classProvCity.php, where manipulating the idName parameter triggers cross-site scripting. Exploitation can be remote; multiple sources flag XSS, with some templates noting a reflected XSS via idName (read.php). ...

CVE-2024-11488

A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/webuser.html. The manipulation of the argument ks leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2018-9468

In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-11490

CVE-2024-11490 affects 115cms up to 20240807. The vulnerability is a Cross-Site Scripting (XSS) in an unknown function of /index.php/admin/web/set.html caused by manipulating the type argument. It can be exploited remotely and public exploits have been disclosed; the vendor reportedly did not res...