CVE-2024-11019

CVE-2024-11019 affects Webopac from Grand Vice info. The connected documents describe a Reflected Cross-site Scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a user’s browser via phishing techniques. CVSSv3.1 base score 6.1 (Medium) with Netw...

Path traversal, lead to arbitrary file write, lead to remote code execution

Description Anythingllm use multer library to handle http multi-part file upload. Anything llm use the following code to handle non-ascii file name file.originalname = Buffer.fromfile.originalname, "latin1".toString "utf8" ; This way of manipulating filename is will lead to path traversal. multer...

PT-2024-32307

Name of the Vulnerable Software and Affected Versions Ikhgur mn.ikhgur.khotoch aka Video Downloader Pro & Browser versions 1.0.42 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component. This could potentially lead...

PT-2024-32306

Name of the Vulnerable Software and Affected Versions allvideo.downloader.browser aka Fast Video Downloader: Browser versions 1.6-RC1 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component. Thi...

PT-2024-32304

Name of the Vulnerable Software and Affected Versions com.superfast.video.downloader aka Super Unlimited Video Downloader - All in One versions 5.1.9 and earlier Description The issue allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity...

CVE-2024-46965: Improper Control of Generation of Code

The DS allvideo.downloader.browser aka Fast Video Downloader: Browser application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component...

PT-2024-32303

Name of the Vulnerable Software and Affected Versions Master Video Downloader versions through 2.0 Description The issue allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component. Recommendations For Master Video Downloader versions through...

CVE-2024-46962: Improper Control of Generation of Code

The SYQ com.downloader.video.fast aka Master Video Downloader application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component...

CVE-2024-46966: Improper Control of Generation of Code

The Ikhgur mn.ikhgur.khotoch aka Video Downloader Pro & Browser application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component...

CVE-2024-46963: Improper Control of Generation of Code

The com.superfast.video.downloader aka Super Unlimited Video Downloader - All in One application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component...

CVE-2024-46962

The SYQ com.downloader.video.fast aka Master Video Downloader application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component...

CVE-2024-46964: Improper Control of Generation of Code

The com.video.downloader.all aka All Video Downloader application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component...

PT-2024-32305

Name of the Vulnerable Software and Affected Versions All Video Downloader versions through 11.28 Description The issue allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component. Recommendations For All Video Downloader versions through 11.28...

CVE-2024-46961: Improper Control of Generation of Code

The Inshot com.downloader.privatebrowser aka Video Downloader - XDownloader application through 1.3.5 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.privatebrowser.activity.PrivateMainActivity component...

CVE-2024-46960: Improper Control of Generation of Code

The ASD com.rocks.video.downloader aka HD Video Downloader All Format application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScript code via the com.rocks.video.downloader.MainBrowserActivity component...

Inshot Video Downloader has a security vulnerability

InShot Inshot Video Downloader is a video download application from InShot. A security vulnerability exists in Inshot Video Downloader version 1.3.5 and earlier, which stems from the presence of an arbitrary JavaScript code execution vulnerability...

Cross-Site Scripting (XSS)

org.apache.nifi,nifi-web-ui is vulnerable to cross-site scripting XSS. The vulnerability is due to insufficient input validation on the description field for Parameters in the Parameter Context configuration, allowing an authenticated user to insert arbitrary JavaScript code, which the client...

IBM CICS TX Standard Web UI Cross-Site Scripting Vulnerability

IBM CICS TX Standard is a comprehensive single transaction runtime package from International Business Machines IBM, Inc. It can provide a cloud-native deployment model for standalone applications. A cross-site scripting vulnerability exists in IBM CICS TX Standard version 11.1, which stems from...

Exploit for Cross-site Scripting in Roundcube Webmail

Exploit Title: Roundcube mail server exploit for CVE-2024-373...

CVE-2024-41745

CVE-2024-41745 affects IBM CICS TX Standard Web UI with a cross-site scripting (XSS) vulnerability. An unauthenticated attacker can embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. IBM-issued guidance indicates the vulnerability is ...