USDA Releases Success Story Detailing the Implementation of Phishing-Resistant Multifactor Authentication

Today, the Cybersecurity and Infrastructure Security Agency CISA and the U.S. Department of Agriculture USDA released Phishing-Resistant Multifactor Authentication MFA Success Story: USDA’s FIDO Implementation. This report details how USDA successfully implemented phishing-resistant authenticatio...

The vulnerability in the pppoe.cgi script of NETGEAR’s router microprogramming software for the XR300, R7000P, and R6400 v2 allows a hacker to cause a service failure.

The vulnerability of the pppoe.cgi script in NETGEAR’s microprogrammed router software, including the XR300, R7000P, and R6400 v2 models, stems from a buffer overflow issue during the processing of the pppoelocalip parameter. Exploiting this vulnerability allows an attacker to initiate a...

PT-2024-35040 · Unknown · Gonzalo Geraldo Adventure Bucket List

Name of the Vulnerable Software and Affected Versions: Gonzalo Geraldo Adventure Bucket List versions 1.0.0 through 1.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS, which can ...

PT-2024-16957 · Hugging Face · Huggingface/Transformers

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this issue,...

PT-2024-35064 · Azonbox · Azonbox

Name of the Vulnerable Software and Affected Versions: AzonBox versions 1.1.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into t...

PT-2024-35003 · Unknown · Matorel Multi-Day Booking Calendar

Name of the Vulnerable Software and Affected Versions: matorel Multi-day Booking Calendar versions n/a through 1.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

PT-2024-35050 · Freshlight · Freshlight Lab Pay With Stripe

Name of the Vulnerable Software and Affected Versions: Freshlight Lab Pay With Stripe versions 1.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacke...

PT-2024-34323 · Auburnforest · Datamentor

Name of the Vulnerable Software and Affected Versions: Auburnforest DataMentor versions n/a through 1.7 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This means that an attacke...

PT-2024-34333 · Sided · Sided

Name of the Vulnerable Software and Affected Versions: Sided versions n/a through 1.4.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to inject maliciou...

(0Day) Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2024-34970 · Unknown · Sazzad Hu Image Carousel Shortcode

Name of the Vulnerable Software and Affected Versions: Sazzad Hu Image Carousel Shortcode versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that the...

(0Day) Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis allows a malicious actor to trigger a service failure.

The vulnerability of the final point of the Splunk Enterprise data model/web REST platform for operational analysis is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability allows a malicious actor to trigger a service failure using a specially creat...

PT-2024-35189 · Unknown · Aa Audio Player

Name of the Vulnerable Software and Affected Versions: AA Audio Player versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. Specifically, it is a DOM-Based XSS vulnerability. This means...

WAGO多款产品 安全漏洞

WAGO PFC100 and others are products of WAGO, Germany.WAGO PFC100 is a programmable logic controller PLC.WAGO CC100 0751-9x01 is a compact controller.WAGO Edge Controller 0752-8303/8000-0002 is a controller. A security vulnerability exists in various WAGO products. The vulnerability stems from the...

Calibre-Web 跨站脚本漏洞

Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. Calibre-Web suffers from a cross-site scripting vulnerability that originates from inserting user input directly into the DOM without proper cleanup. An...

PT-2024-16860 · Code Projects · Code-Projects Inventory Management

Name of the Vulnerable Software and Affected Versions: code-projects Inventory Management version 1.0 Description: A critical issue has been identified, affecting the /model/editProduct.php file. The manipulation of the id argument leads to SQL injection. This issue can be exploited remotely...

Code-Projects Inventory Management System 注入漏洞

Inventory Management is an inventory management system. Inventory Management suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the id parameter of the /model/editProduct.php file. An attacker can exploit this vulnerability to...

Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx

...

Cross-Site Scripting (XSS)

github.com/mudler/localai is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input validation and inadequate sanitization of user inputs when passing parameters to the delete model API, allows malicious scripts to be stored and executed in the application...