PT-2024-41012 · Unknown · Govulncheck-Vulndb

Name of the Vulnerable Software and Affected Versions: govulncheck-vulndb versions prior to 0.0.20241028T152002 Description: The issue concerns updates to the govulncheck-vulndb, which includes various Go CVE Numbering Authority IDs that have been added or updated. No specific details about the...

CVE-2024-50348 InstantCMS has a Cross Site Scripting Vulnerability

InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS Cross Site Scripting payload and execute. This vulnerability is fixed in 2.16.3...

Deserialization of Untrusted Data

Overview chainer is an A flexible framework of neural networks Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the chainermn module, in the communication utility component. Details Serialization is a process of converting an object into a sequence of byte...

CVE-2024-10228 Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user

The Vagrant VMWare Utility Windows installer targeted a custom location with a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes. This vulnerability, CVE-2024-10228, was fixed in Vagrant VMWare Utility 1.0.23...

CVE-2024-48921 Kyverno's PolicyException objects can be created in any namespace by default

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this...

CVE-2024-7473

An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3...

PT-2024-33616 · Unknown · Chatplusjp

Name of the Vulnerable Software and Affected Versions: chatplusjp versions n/a through 1.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into a website,...

WordPress Arconix Shortcodes Plugin <= 2.1.13 is vulnerable to Cross Site Scripting (XSS)

Software Arconix Shortcodes Type Plugin Vulnerable versions = 2.1.13 Fixed in 2.1.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10226 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c6233411bd7c Credits Peter Thaleikis...

WordPress Newsletters Plugin <= 4.9.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletters Type Plugin Vulnerable versions = 4.9.9.4 Fixed in 4.9.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10181 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 21f5eb2f7bba Credits Peter Thaleikis Require...

WordPress affiliate-toolkit Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS)

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10227 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 78a335fc5aaa Credits Peter Thaleikis...

WordPress FileOrganizer Plugin <= 1.0.9 is vulnerable to Arbitrary File Upload

Software FileOrganizer Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7985 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9a28a4363098 Credits TANG Cheuk Hei siunam Required privilege...

PT-2024-34200 · Unknown · Survey Maker

Name of the Vulnerable Software and Affected Versions: Survey Maker versions through 5.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions...

WordPress SEUR Oficial Plugin <= 2.2.11 is vulnerable to Cross Site Scripting (XSS)

Software SEUR Oficial Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9438 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 09ee4a264f33 Credits vgo0 Required...

PT-2024-10318 · Ibm · Ibm Qradar Wincollect Agent

Name of the Vulnerable Software and Affected Versions: IBM QRadar WinCollect Agent versions 10.0.0 through 10.1.12 Description: The issue is related to the improper input validation of assumed immutable data, which could allow a remote attacker to inject XML data into parameter values. This could...

WordPress Posti Shipping Plugin <= 3.10.2 is vulnerable to Full Path Disclosure (FPD)

Software Posti Shipping Type Plugin Vulnerable versions = 3.10.2 Fixed in 3.10.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-50512 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f13c6383cb59 Credits Fariq Fadillah Gusti...

PT-2024-34255 · Woocommerce · Woocommerce Quote Calculator

Name of the Vulnerable Software and Affected Versions: WooCommerce Quote Calculator versions 1.1 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection...

WordPress Contact Form 7 Telegram Plugin <= 0.8.5 is vulnerable to Broken Access Control

Software Contact Form 7 Telegram Type Plugin Vulnerable versions = 0.8.5 Fixed in 0.8.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9629 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bc9031e15885 Credits István Márton Required...

PT-2024-34190 · Woocommerce · Wpc Shop As A Customer For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPC Shop as a Customer for WooCommerce versions 1.2.6 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, although specific details about the...

CVE-2024-47821 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to improper authorization via the add method in controller\Index.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin...