CVE-2024-7188 Bylancer Quicklancer GET Parameter listing sql injection

A vulnerability was found in Bylancer Quicklancer 2.4. It has been rated as critical. This issue affects some unknown processing of the file /listing of the component GET Parameter Handler. The manipulation of the argument range2 leads to sql injection. The attack may be initiated remotely. The...

PT-2024-29475 · Unknown · Aml Surety Eco

Name of the Vulnerable Software and Affected Versions: AML Surety Eco versions up to 3.5 Description: The issue allows an attacker to run arbitrary code via a crafted GET request using the id parameter. This is a Cross Site Scripting XSS issue. Recommendations: For AML Surety Eco versions up to...

AML Surety Eco 安全漏洞

AML Surety Eco is an end-to-end BSA/AML ecosystem from AML. A security vulnerability exists in AML Surety Eco version 3.5 and earlier, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to run arbitrary code via a specially crafted GET request...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

TOTOLINK A3100R 安全漏洞

TOTOLINK A3100R is a series of wireless routers from China's Gion Electronics TOTOLINK. The TOTOLINK A3100R version 4.1.2cu.5050B20200504 suffers from a buffer overflow vulnerability that originates in the getSaveConfig function of /cgi-bin/cstecgi.cgi?action=save&setting where the httphost fails...

CVE-2024-39304 ChurchCRM SQL Injection Vulnerability

ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQ...

CVE-2024-41812 txtdot SSRF vulnerability in /get

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery SSRF vulnerability in the /get route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to...

CVE-2024-41812 txtdot SSRF vulnerability in /get

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery SSRF vulnerability in the /get route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to...

SUSE CVE-2024-6874

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

TxtDot 安全漏洞

TxtDot is an HTTP proxy from the TxtDot open source. A security vulnerability exists in TxtDot version 1.4.0 through versions prior to 1.6.1. A remote attacker could exploit the vulnerability to send HTTP GET requests to arbitrary targets using the server as a proxy and retrieve information on an...

streamlit-geospatial 代码问题漏洞

streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A code issue vulnerability exists in streamlit-geospatial that stems from pages/7? The url variable in WebMapService.py accepts user input that is passed to the getlayers...

PT-2024-35516

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer error issue has been resolved in the Linux kernel. The problem was addressed by adding an encoder check in hdcp2 get capability and intel hdcp2 get capability to prevent t...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

A flaw was found in the Linux kernel. A potential data-race in the nftexprtypeget function exists...

kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

A potential data-race flaw was found in nftobjtypeget in the Linux kernel. This issue can lead to a crash...

AZL-49664 CVE-2024-6874 affecting package cmake for versions less than 3.30.3-2

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

Unauthorized Access

alextselegidis/easyappointments is vulnerable to Unauthorized Access. The vulnerability is due to insufficient access controls in the GET, PUT, DELETE /providers/providerId endpoints, allowing a low privileged user to fetch, modify, or delete a privileged user's data...

PT-2024-28842 · Unknown · Stitionai/Devika

Name of the Vulnerable Software and Affected Versions: stitutionai devika version v1 Description: The issue concerns a path traversal attack through the snapshot path parameter in the "/api/get-browser-snapshot" endpoint. This allows an attacker to manipulate the snapshot path parameter, traverse...

CVE-2024-6969

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/getpatienthistory.php. The manipulation of the argument patientid leads to sql injection. The attack may be initiated...

PT-2024-8127 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version V1.0.1-B20201211.2000 Description: The issue is related to the get apcli conn info function in the TOTOLINK A6000R router's firmware, which fails to neutralize special elements used in an OS command. This can be...