CVE-2024-1664

CVE-2024-1664 affects the WordPress plugin Responsive Gallery Grid (versions prior to 2.3.11). The vulnerability arises from insufficient sanitisation/escaping of several settings, which could allow high-privilege users (e.g., administrators) to perform Stored XSS, including in multisite configur...

CVE-2024-0082

CVE-2024-0082 (NVIDIA ChatRTX for Windows) affects NVIDIA ChatRTX for Windows, describing a vulnerability in the UI that allows an attacker to cause improper privilege management by sending open file requests to the application, potentially enabling local privilege escalation, information disclos...

CVE-2023-7164

BackWPup WordPress plugin before 4.0.4 exposes a directory listing vulnerability in its temporary backup folder, allowing unauthenticated attackers to download site backups (database files). Root cause: lack of access restrictions on the backup directory. Impact: potential data exposure of backup...

CVE-2024-1958

CVE-2024-1958 affects the WPB Show Core WordPress plugin prior to version 2.7, where a parameter is not sanitised/escaped before being output on the page, causing a Reflected XSS vulnerability. Patch/upgrade to WPB Show Core 2.7 or later to remediat​e; the vulnerability is triggered via output re...

CVE-2024-1589

The CVE-2024-1589 issue affects the WordPress SendPress Newsletters plugin up to version 1.23.11.6. The root cause is that certain settings are not properly sanitised/escaped, enabling Stored Cross-Site Scripting (stored XSS) by high-privilege users (e.g., admins), even when unfiltered_html is di...

PT-2024-23663

Name of the Vulnerable Software and Affected Versions InfluxDB OSS versions 2.x through 2.7.11 Description The issue allows authorized users with read access to the authorization resource of the default organization to retrieve the administrative operator token. This is possible because the token...

capaz.org.pe Cross Site Scripting vulnerability OBB-3902833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-30250

Astro-Shield (KindSpells) vulnerability CVE-2024-30250 affects versions 1.2.0–1.3.1, where injecting a correct SRI attribute into code causes the injected resource to be considered legitimate by CSP, enabling bypass of cross-origin allow-lists. Root cause: the SRI hash is added to the CSP header,...

CVE-2024-22189

The CVE concerns quic-go prior to v0.42.0 where an attacker can cause memory exhaustion on the peer by flooding with NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is expected to reply with RETIRE_CONNECTION_ID frames for each retirement; an attacker can prevent most of the...

iscchina.org Cross Site Scripting vulnerability OBB-3901499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

Esri Portal For ArcGIS 跨站脚本漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS that stems from vulnerability to cross-site scripting attac...

编号撤回

Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. This CVE number has been withdrawn...

Esri Portal For ArcGIS 安全漏洞

Esri Portal For ArcGIS is a component of Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal For ArcGIS that stems from the presence of a cross-site scripting vulnerability...

CVE-2024-22360

CVE-2024-22360 (IBM Db2 on Cloud Pak for Data) is a denial-of-service issue triggered by a specially crafted query on certain columnar tables. Affected products include IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, with versions listed as v3.5 through various refresh leve...

CVE-2023-52296

Technical details about CVE-2023-52296 are not publicly provided in the connected documents. The available description notes a denial-of-service when querying a specific UDF concurrently in IBM Db2 11.5. Monitor for updates.

CVE-2024-25046

CVE-2024-25046 affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Authenticated user can trigger a denial of service via a specially crafted query against Db2 components (versions 3.5 through latest refresh). The issue has a remediation path: upgrade to the latest Cloud...

CVE-2024-25030

CVE-2024-25030 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (v3.5–refresh 10, v4.0–refresh 9, v4.5–refresh 3, v4.6–refresh 6, v4.7–refresh 4, v4.8–refresh 4). The issue is that 11.1 releases store potentially sensitive information in log files readable by a local ...

CVE-2024-25918

CVE-2024-25918 affects the WordPress plugin InstaWP Connect (InstaWP) Suite. The vulnerability is described as Unrestricted Upload of File with Dangerous Type, enabling remote code execution (RCE). Affected versions: InstaWP Connect from n/a through 0.1.0.8. Public writeups/reports in connected d...