CVE-2024-38739

CVE-2024-38739 affects the OnePress WordPress theme (versions up to 2.3.8). It is described as a Stored Cross-Site Scripting (XSS) vulnerability in input handling during web page generation. The connected documents confirm the issue but do not provide a patch version or remediation details; no ex...

CVE-2024-0857

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0...

CVE-2024-0857

CVE-2024-0857 concerns an SQL Injection in FlexWater Corporate Water Management from Universal Software Inc. The PT-2024-15870 entry specifies the vulnerable line as versions prior to 5.452.0, with remediation to upgrade to 5.452.0 or later and a temporary measure to restrict access to sensitive ...

WordPress plugin WPCS injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An injection...

PT-2024-5534 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions 21.1R1-EVO through 21.2R3-S8-EVO Junos OS Evolved versions prior to 21.4R3-S7-EVO Junos OS Evolved versions prior to 22.1R3-S6-EVO Junos OS Evolved versions prior to 22.2R3-EVO Junos OS Evolved versions prior to...

PT-2024-5354 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions 22.3-EVO before 22.3R2-EVO Junos OS Evolved versions 22.4-EVO before 22.4R1-S1-EVO, 22.4R2-EVO Description: An Improper Neutralization of Special Elements issue in Juniper Networks Junos OS Evolved commands allows a...

PT-2024-5355 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 20.4R3-S7-EVO Junos OS Evolved versions 21.2-EVO prior to 21.2R3-S8-EVO Junos OS Evolved versions 21.4-EVO prior to 21.4R3-S7-EVO Junos OS Evolved versions 22.1-EVO prior to 22.1R3-S6-EVO Junos OS Evolved...

CVE-2024-37546

CVE-2024-37546 concerns the WordPress plugin “Image Hover Effects – Caption Hover with Carousel” (versions

CVE-2024-37539

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0...

CVE-2024-5672 Red Lion Europe: mbNET.mini vulnerable to OS command injection

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command...

CVE-2024-5672

CVE-2024-5672 affects MB Connect Line mbNET.mini (industrial router) up to version 2.2.11, with the issue caused by improper neutralization of special elements in OS commands. This enables a high-privileged, authenticated attacker to inject and execute arbitrary system commands via GET requests, ...

CVE-2024-38857

CVE-2024-38857 affects Checkmk prior to versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL). The issue is improper neutralization of input in Checkmk that allows attackers to craft malicious links, enabling phishing attacks. Reported impact notes include user interaction required and potential ...

GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security...

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update E)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.0 ATTENTION : Exploitable remotely Vendor : ICONICS, Mitsubishi Electric Equipment : ICONICS Product Suite Vulnerabilities : Allocation of Resources Without Limits or Throttling, Improper Neutralization, Uncontrolled Search Path Element, Improper...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

LocalAI Operating System Command Injection Vulnerability

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An OS command injection vulnerability exists in localai version 2.14.0, which stems from improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrar...

CVE-2024-35768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiveComposer Page Builder: Live Composer live-composer-page-builder allows DOM-Based XSS.This issue affects Page Builder: Live Composer: from n/a through = 2.1.11...

CVE-2024-35757

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.This issue affects Easy Age Verify: from n/a through 1.8.2...

CVE-2024-35774

CVE-2024-35774: Stored XSS in D’arteweb DImage 360 (DImage 360) due to improper neutralization of input during web page generation; affects DImage 360 versions up to 2.0. The issue is a stored cross-site scripting vulnerability; the root cause is incorrect handling of user input in page rendering...

CVE-2024-35779

CVE-2024-35779 is an XSS vulnerability described as Stored XSS in Live Composer Page Builder (WordPress plugin) affecting versions from n/a up to 1.5.42. The connected records corroborate a Live Composer vulnerability and identify the issue type as Stored XSS for this CVE; exploitation details ar...