WordPress plugin Tutor LMS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin WP Dashboard Notes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-27442

An issue was discovered in Zimbra Collaboration ZCS 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of...

USN-6946-1 python-django vulnerabilities

It was discovered that Django incorrectly handled certain strings in floatformat function. An attacker could possibly use this issue to cause a memory exhaustion. CVE-2024-41989 It was discovered that Django incorrectly handled very large inputs. An attacker could possibly use this issue to cause...

CVE-2024-6886 Inproper Sanitation of field leading to stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

PT-2024-29629 · Poly · Poly Clariti Manager

Name of the Vulnerable Software and Affected Versions: Poly Clariti Manager versions up to 10.10.2.2 Description: A flaw was discovered in the firmware that does not properly neutralize input during web page generation. Recommendations: For versions up to 10.10.2.2, update to a version later than...

HP Poly Clariti Manager devices 安全漏洞

HP Poly Clariti Manager devices is a device management system from Hewlett-Packard HP in the United States. A security vulnerability exists in HP Poly Clariti Manager devices version 10.10.2.2 and prior versions, which stems from an inability to properly neutralize input during web page generatio...

PT-2024-5725 · Microsoft · Dynamics 365 +1

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics CRM affected versions not specified Microsoft Dynamics 365 affected versions not specified Description: The issue exists due to inadequate protection of the web page structure in Microsoft Dynamics CRM, allowing for imprope...

Heap Overflow Flaw

389-ds-base is vulnerable to a heap overflow flaw. The vulnerability is due to improper handling of input sizes when writing a value larger than 256 characters in the logentryattr, leading to memory corruption. Attackers can exploit this flaw to cause a denial of service, potentially crashing the...

CVE-2024-39647

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through 1.6.1.1...

CVE-2024-39629

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.2...

CVE-2024-6529

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

VulnCheck KEV: CVE-2024-39663

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through = 1.68.232...

PT-2024-28563 · WordPress · Nextgen Gallery

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery versions 3.59.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, which can lead to malicious scri...

The vulnerability of the software for processing, transforming, and generating documents using Ghostscript arises from the improper neutralization of special elements used in operating system commands. This allows an attacker to execute arbitrary code.

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to the introduction of a specially created pipe command. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

PT-2024-27999 · Matrix · Matrix

Name of the Vulnerable Software and Affected Versions: Matrix affected versions not specified Description: The issue is related to improper neutralization of input during web page generation, which can lead to cross-site scripting. This allows attackers to inject malicious scripts into web pages...

PT-2024-38094 · Unknown · Stackposts Social Marketing Tool

Name of the Vulnerable Software and Affected Versions: Stackposts Social Marketing Tool affected versions not specified Description: The issue allows for a Cross-site Scripting XSS attack due to improper neutralization of input during web page generation. This can be exploited by submitting a...

Matrix Tafnit 跨站脚本漏洞

Matrix Tafnit is an enterprise resource planning solution from Matrix. A cross-site scripting vulnerability exists in Matrix Tafnit version v8, which stems from improper input neutralization during web page generation and is susceptible to cross-site scripting attacks...

CVE-2024-42075

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix remap of arena. The bpf arena logic didn't account for mremap operation. Add a refcnt for multiple mmap events to prevent use-after-free in arenavmclose...

SDoP contains a stack-based buffer overflow vulnerability.

Overview SDoP fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability CWE-121. Yuhei Kawakoya of NTT Security Holdings reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...