Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update E)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.0 ATTENTION : Exploitable remotely Vendor : ICONICS, Mitsubishi Electric Equipment : ICONICS Product Suite Vulnerabilities : Allocation of Resources Without Limits or Throttling, Improper Neutralization, Uncontrolled Search Path Element, Improper...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

PT-2024-27410

Name of the Vulnerable Software and Affected Versions jQuery T- Countdown Widget versions n/a through 2.3.25 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in the jQuery T- Countdo...

CVE-2024-4957: Improper Neutralization of Input During Web Page Generation

The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

LocalAI Operating System Command Injection Vulnerability

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An OS command injection vulnerability exists in localai version 2.14.0, which stems from improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrar...

CVE-2024-4639: Improper Neutralization of Special Elements used in a Command

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands...

CVE-2024-31111: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6,...

CVE-2024-4754: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-35768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows DOM-Based XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22...

CVE-2024-35757

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.This issue affects Easy Age Verify: from n/a through 1.8.2...

CVE-2024-35774

CVE-2024-35774: Stored XSS in D’arteweb DImage 360 (DImage 360) due to improper neutralization of input during web page generation; affects DImage 360 versions up to 2.0. The issue is a stored cross-site scripting vulnerability; the root cause is incorrect handling of user input in page rendering...

CVE-2024-35779

CVE-2024-35779 is an XSS vulnerability described as Stored XSS in Live Composer Page Builder (WordPress plugin) affecting versions from n/a up to 1.5.42. The connected records corroborate a Live Composer vulnerability and identify the issue type as Stored XSS for this CVE; exploitation details ar...

PT-2024-26720

Name of the Vulnerable Software and Affected Versions WPPizza versions 3.18.13 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations For versions 3.18.13 a...

CVE-2024-35762: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4...

PT-2024-26723

Name of the Vulnerable Software and Affected Versions John West Slideshow SE versions 2.5.17 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For...

CVE-2024-5058: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WPDeveloper Typing Text allows Stored XSS.This issue affects Typing Text: from n/a through 1.2.5...

PT-2024-26711

Name of the Vulnerable Software and Affected Versions 5 Star Plugins Easy Age Verify versions 1.8.2 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2024-26716

Name of the Vulnerable Software and Affected Versions Serious Slider versions 1.2.4 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For versions...

PT-2024-26717

Name of the Vulnerable Software and Affected Versions Theme Freesia Excellent versions 1.2.9 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For...

PT-2024-26713

Name of the Vulnerable Software and Affected Versions WP Job Portal versions n/a through 2.1.3 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For WP Job...