5589 matches found
GHSA-QX44-885H-7P56 Cross site scripting in opencart
This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...
CVE-2024-21515
This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. The user is then prompted to login a...
CVE-2024-21515
CVE-2024-21515 affects opencart/opencart 4.0.0.0+. A reflected XSS in the filename parameter of the admin tool/log route could enable an attacker to trick an admin user into exposing a token, prompting login, and executing a payload after authentication. If the attacker has admin privileges, this...
SUSE CVE-2024-38589
In the Linux kernel, the following vulnerability has been resolved: netrom: fix possible dead-lock in nrrtioctl syzbot loves netrom, and found a possible deadlock in nrrtioctl 1 Make sure we always acquire nrnodelistlock before nrnodelocknrnode 1 WARNING: possible circular locking dependency...
PT-2024-18930 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: opencart/opencart version 4.0.0.0 Description: A reflected XSS issue was identified in the redirect parameter of the "customer account/login" route. An attacker can inject arbitrary HTML and Javascript into the page response. This issue is...
Linux Kernel ICMPv6 Router Advertisement Race Condition Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of Route Information options. The issue results from the lack of...
PT-2024-18928 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: opencart/opencart version 4.0.0.0 Description: A reflected XSS issue was identified in the filename parameter of the "admin tool/log" route. An attacker could obtain a user's token by tricking the user to click on a maliciously crafted URL. T...
PT-2024-18929 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: opencart/opencart versions 4.0.0.0 through 4.1.0.0 Description: A reflected XSS issue was identified in the directory parameter of the admin common/filemanager.list route. An attacker could obtain a user's token by tricking the user to click ...
CVE-2024-5522
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2024-5522 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2024-5522
The HTML5 Video Player WordPress plugin, in versions prior to 2.5.27 , is vulnerable to SQL injection because it fails to properly sanitize and escape a parameter from a REST route before including it in a SQL statement. This flaw allows unauthenticated users to execute arbitrary SQL queries, whi...
CVE-2024-5522: Improper Neutralization of Special Elements used in an SQL Command
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...
UBUNTU-CVE-2024-38589
In the Linux kernel, the following vulnerability has been resolved: netrom: fix possible dead-lock in nrrtioctl syzbot loves netrom, and found a possible deadlock in nrrtioctl 1 Make sure we always acquire nrnodelistlock before nrnodelocknrnode 1 WARNING: possible circular locking dependency...
PT-2024-26903 · Unknown · Reposilite
Name of the Vulnerable Software and Affected Versions: Reposilite versions 3.5.10 through 3.5.11 Description: The issue is related to an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. This occurs because the GET /javadoc/repository//raw/ route uses the...
bgpd/bgp_packet.c Out-of-Memory Disclosure DoS
The vulnerability of the bgpd/bgppacket.c file in the networking routing implementation software for Unix-like systems in FRRouting is related to reading the initial byte of the ORF header during a race condition. Exploiting this vulnerability can allow a malicious actor to disclose sensitive...
Updated libndp packages fix security vulnerabilities
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route length information...
PT-2024-29176
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc2-syzkaller-00249-gbe27b8965297 Description A vulnerability in the Linux kernel has been resolved, which prevents a possible NULL pointer dereference in the fib6 nh init function. The issue occurs becaus...
PT-2024-30340
Name of the Vulnerable Software and Affected Versions parisneo/lollms version 9.5 Description The issue arises from insufficient path sanitization, allowing Local File Inclusion LFI attacks. The sanitize path from endpoint function fails to properly sanitize Windows-style paths backward slash ,...
CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...
CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management CRM software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the issue...