TOTOLINK LR350 License Issue Vulnerability

TOTOLINK LR350 is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK LR350 suffers from an authorization issue vulnerability that stems from an input value of 1 for the parameter authCode in /formLoginAuth.htm, which can lead to authorization bypass. No detailed vulnerability...

CVE-2024-51556

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

PT-2024-7561 · Beckhoff · Twincat Package Manager

Name of the Vulnerable Software and Affected Versions: TwinCAT Package Manager affected versions not specified Description: A local user with administrative access rights can enter specially crafted values for settings at the user interface UI of the TwinCAT Package Manager, which can cause...

CVE-2024-10199

A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /managemedicine.php of the component Manage Medicines Page. The manipulation of the argument...

PT-2024-16044 · Unknown · Wfh45678 Radar

Name of the Vulnerable Software and Affected Versions: wfh45678 Radar versions up to 1.0.8 Description: A critical issue affects the Interface Handler component, allowing for authorization bypass through manipulation of the input /../. This can be initiated remotely and is not considered a path...

Arbitrary Code Injection

Overview flair is an A very simple framework for state-of-the-art NLP Affected versions of this package are vulnerable to Arbitrary Code Injection through the function ClusteringModel of the file flair\models\clustering.py. An attacker can execute arbitrary code by manipulating the input data to...

CVE-2024-9142

CVE-2024-9142 affects Olgu Computer Systems’ e-Belediye prior to version 2.0.642. The root cause is incorrect permission assignment for a critical resource, enabling external control of file name or path and allowing manipulation of web input to file system calls. According to connected sources, ...

CVE-2024-9084

A vulnerability classified as problematic was found in code-projects Blood Bank System 1.0. This vulnerability affects unknown code of the file bbms.php. The manipulation of the argument fullname/age/bloodgroup/city/phno/gender as part of String leads to cross site scripting. The attack can be...

PT-2024-39100 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects the file /endpoint/update.php, where the manipulation of the first name, middle name, and last name arguments...

The vulnerability of the Kerberos protocol for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Kerberos protocol for Windows operating systems is related to manipulating an unknown input, resulting in a time mismatch vulnerability. Exploiting this vulnerability allows a remote attacker to increase their privileges...

CVE-2024-6523

A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of the component system-group-add Handler. The manipulation of the argument user with the input alert'XSS' leads to cross site scripting. It is possible to launch the...

CVE-2024-5193 Ritlabs TinyWeb Server Request crlf injection

A security vulnerability has been detected in Ritlabs TinyWeb Server 1.94. This vulnerability affects unknown code of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to initiate the attack remotely. The exploit has been disclosed...

CVE-2024-24934 WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Elementor Elementor Website Builder allows Manipulating Web Input to File System Calls.This issue affects Elementor Website Builder: from n/a through 3.19.0...

CVE-2023-26526

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1...

CVE-2024-4491

A vulnerability classified as critical was found in Tenda i21 1.0.0.144656. This vulnerability affects the function formGetDiagnoseInfo. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the publ...

PT-2024-27700 · Xiongmai · Xiongmai Ahb7004T-Gs-V3 +6

Name of the Vulnerable Software and Affected Versions: Xiongmai AHB7804R-MH-V2 Xiongmai AHB8004T-GL Xiongmai AHB8008T-GL Xiongmai AHB7004T-GS-V3 Xiongmai AHB7004T-MHV2 Xiongmai AHB8032F-LME Xiongmai XM530 R80X30-PQ 8M Description: A critical vulnerability was found in the Sofia Service component ...

PT-2024-27493 · Unknown · Smart Office

Name of the Vulnerable Software and Affected Versions: Smart Office versions up to 20240405 Description: A vulnerability was found in the file Main.aspx, where the manipulation of the New Password/Confirm Password argument with the input 1 leads to weak password requirements. The attack can be...

Cache Poisoning Vulnerability

Summary An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. Details The opt.id parameter allows the overwriting of the cache key. If an attacker sets the id...

Cross site scripting

A vulnerability classified as problematic was found in SourceCodester Testimonial Page Manager 1.0. This vulnerability affects unknown code of the file add-testimonial.php of the component HTTP POST Request Handler. The manipulation of the argument name/description/testimony leads to cross site...

Cross site scripting

A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the component New Account Handler. The manipulation of the argument First Name/Last Name with the input alert1 leads to cross site scripting. The...