QNAP QuMagie 信任管理问题漏洞

QNAP Systems QuMagie is a QTS photo management application from China Weilian Technology QNAP Systems. A trust management issue vulnerability exists in QNAP QuMagie version 2.3.1 and prior versions, which stems from the inclusion of an incorrect certificate validation vulnerability. An attacker w...

PT-2024-31626 · Unknown · Advanced Custom Fields Pro

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields versions 6.3.5 and earlier Advanced Custom Fields Pro versions 6.3.5 and earlier Description: A cross-site scripting issue exists, allowing an attacker with the capability setting privilege to store an arbitrary script ...

CVE-2021-22529

A vulnerability identified in NetIQ Advance Authentication that leaks sensitive server information. This issue affects NetIQ Advance Authentication version before 6.3.5.1...

WordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by LeNgocHoa in WordPress Plugin Maintenance & Coming Soon Redirect Animation versions = 2.3.3...

PT-2024-40507 · Diesel · Diesel

Name of the Vulnerable Software and Affected Versions: Diesel versions prior to 2.2.3 Description: The issue concerns a SQL injection vulnerability that can be exploited by encoding a value larger than 4GiB, causing the length prefix in the protocol to overflow. This can lead to the server...

CVE-2024-39745

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

IBM Sterling Connect:Direct Web Services 安全漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services versions 6.0, 6.1, 6.2, and 6.3 that stems from a failure to properly enable HTTP...

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by John Blackbourn Patchstack Alliance in WordPress Plugin LiteSpeed Cache versions = 6.3.0.1...

CVE-2024-43145

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61...

CVE-2024-43346

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3...

DedeBIZ 代码问题漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A code issue vulnerability exists in DedeBIZ version 6.3.0, which stems from the parameter upfile1 in the file admin/filemanagecontrol.php that can lead to unrestricted uploads...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ version 6.3.0, which stems from the parameter upfile1 in the file admin/mediaadd.php that can lead to unrestricted uploads...

CVE-2024-7887 LimeSurvey File Upload index.php denial of service

A vulnerability was found in LimeSurvey 6.3.0-231016 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php of the component File Upload. The manipulation of the argument size leads to denial of service. The attack may be launched remotely. The...

WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Void Elementor Post Grid Addon for Elementor Page builder versions = 2.3...

PT-2024-5814 · Dovecot +10 · Dovecot Imap Server +10

Name of the Vulnerable Software and Affected Versions: Dovecot IMAP Server versions 2.2 through 2.3.20 Description: The issue is related to the excessive CPU usage caused by a large number of address headers in emails, which can be exploited by external actors to consume system resources and caus...

WordPress Visual Composer Starter theme <= 3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Visual Composer Starter versions = 3.3...

PT-2024-29436 · Feripro · Feripro

Name of the Vulnerable Software and Affected Versions: Feripro versions prior to 2.2.3 Description: The issue concerns an Incorrect Access Control vulnerability. It affects the "/admin/programm//export/statistics" endpoint, allowing remote attackers to export an XLSX file containing information...

CVE-2024-6578 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

CVE-2024-37117

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected XSS.This issue affects Uncanny Automator Pro: from n/a through 5.3...

PT-2024-28130 · Fancypost · Fancypost

Name of the Vulnerable Software and Affected Versions: FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor versions through 5.3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as...