Sensaphone WEB600 Monitoring System Cross Site Scripting

The Sensaphone WEB600 Monitoring System was found to suffer from multiple persistent cross site scripting vulnerabilities...

Grafana Labs 10.4.x < 10.4.15 / 11.0.x < 11.0.11 / 11.1.x < 11.1.11 / 11.2.x < 11.2.6 / 11.3.x < 11.3.3 / 11.4.x < 11.4.1, 11.5.0 (cve-2024-11741)

The version of Grafana Labs installed on the remote host is prior to 10.4.15, 11.0.11, 11.1.11, 11.2.6, 11.3.3, or 11.4.1, 11.5.0. It is, therefore, affected by a vulnerability as referenced in the cve-2024-11741 advisory. - Grafana is an open-source platform for monitoring and observability. The...

CVE-2025-24968 Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine

reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as penetrationtester or auditor to delete all projects in the system. This can lead to a complete system takeover by redirecting the...

CISA Partners with ASD’s ACSC, CCCS, NCSC-UK, and Other International and US Organizations to Release Guidance on Edge Devices

CISA—in partnership with international and U.S. organizations—released guidance to help organizations protect their network edge devices and appliances, such as firewalls, routers, virtual private networks VPN gateways, Internet of Things IoT devices, internet-facing servers, and internet-facing...

BIT-GRAFANA-2024-11741

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15...

NagVis security vulnerability

NagVis is a program from NagVis open source. It is used to visualize your chosen monitoring core data in a user-friendly way. NagVis has a security vulnerability that stems from vulnerability to remote code execution attacks...

medical device monitoring systems Information Disclosure Man-in-the-Middle

The vulnerability of the microprogrammed software used in medical devices for monitoring patient status, such as the CMS8000 Patient Monitor and Epsimed MN-120, stems from the unauthorized provision of information to individuals who are not authorized. This occurs due to the use of a rigidly code...

CVE-2025-24957

creationtimestamp| type| source ---|---|--- 2025-02-03 22:04:06+00:00| seen| https://infosec.exchange/users/cve/statuses/113942216465394142 2025-02-03 22:16:22+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhckz2bk262n 2025-02-03 23:40:44+00:00| seen|...

CVE-2025-24962 Command Injection in reNgine

reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmapcmd parameters. This issue has been addressed in commit c28e5c8d and is expected in the next versioned release. Users are advised to filter user input and monitor the...

GHSA-F8MX-CWFH-7HR2 TShock allows chat while not fully connected, possible ban evasion

This issue was reported to TShock by @ohayo, but was found by the Discord user by the name of sofurry.com. Please note that this user does not own this domain on the internet, just the discord handle. TShock overrides certain Terraria vanilla systems, including chat, and the connection handling,...

FortiManager Directory Path Execution Arbitrary Code

The vulnerability of the software for centralized device management of Fortinet FortiManager, as well as security event monitoring and analysis tools FortiAnalyzer, is related to errors in processing the relative path to the directory. Exploiting this vulnerability allows a malicious actor to...

CVE-2024-57498

creationtimestamp| type| source ---|---|--- 2025-02-02 10:14:37+00:00| seen| https://gist.github.com/Catherines77/ac0b554f3d755879eb12bfd69ef585b1 2025-02-03 20:16:38+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhcecwsc7b2e 2025-02-03 20:23:10+00:00| seen|...

CVE-2025-0946

creationtimestamp| type| source ---|---|--- 2025-02-01 16:15:47+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh4vwgqemg27 2025-02-01 17:25:47+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/3772 2025-02-01 17:37:45+00:00| seen|...

CVE-2024-11741

Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15...

WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin WP Sessions Time Monitoring Full Automatic versions = 1.1.1...

CVE-2025-24718 WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through = 1.1.1...

CVE-2025-24718 WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through = 1.1.1...

CVE-2025-24718

CVE-2025-24718 refers to a reflected XSS in the WordPress plugin “WP Sessions Time Monitoring Full Automatic” (SWIT) for versions up to 1.1.1. The issue stems from improper input neutralization during web page generation. Public docs show a CVSSv3.1 base score of 7.1 (HIGH) with network attack ve...

PT-2025-5532 · WordPress · Swit Wp Sessions Time Monitoring Full Automatic

Name of the Vulnerable Software and Affected Versions: SWIT WP Sessions Time Monitoring Full Automatic versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This mean...

CVE-2025-24718: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Reflected XSS.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through = 1.1.1...