CVE-2024-7908

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected is the function setDefResponse of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument IpAddress leads to stack-based buffer overflow. It is possible to launch the attack...

WordPress Ai Image Alt Text Generator for WP plugin <= 1.0.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Ai Image Alt Text Generator for WP versions = 1.0.6...

observaciones-andromeda.es Cross Site Scripting vulnerability OBB-4018339

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ivanti Avalanche path traversal vulnerability (CNVD-2025-15477)

Ivanti Avalanche is an enterprise mobile device management MDM solution for managing devices such as smartphones, tablets, and industrial mobile computers to ensure their security, availability, and accessibility. Ivanti Avalanche suffers from a path traversal vulnerability that stems from the...

go-git clients vulnerable to DoS via maliciously crafted Git server replies

Impact A denial of service DoS vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. This is a go-g...

CVE-2020-9086

Summary: CVE-2020-9086 describes a buffer error vulnerability in some Huawei products where an unauthenticated attacker can trigger a flaw by sending specially crafted UPnP messages to vulnerable devices, due to insufficient input validation. The consequence is a potential service abnormality, wi...

WordPress WP Publications plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Zeynalxan Quliyev, Revan Poladl in WordPress Plugin WP Publications versions = 1.2...

CVE-2022-44515

CVE-2022-44515 affects Adobe Acrobat Reader DC (versions 22.001.20085 and earlier; 20.005.3031x and earlier; 17.012.30205 and earlier). The vulnerability is an out-of-bounds read when parsing a crafted file, allowing read past the end of an allocated memory structure and potentially bypassing mit...

CVE-2023-40334

CVE-2023-40334 affects the HUSKY – Products Filter for WooCommerce (formerly WOOF) WordPress plugin. Affected versions are

CVE-2023-48274

CVE-2023-48274 describes a Missing Authorization vulnerability in the WordPress plugin WCMultiShipping (Mondial Relay for WooCommerce). Affected versions are

CVE-2023-49818

CVE-2023-49818 affects the WordPress plugin Webflow Pages (Webflow Pages) up to version 1.0.8. The issue is a Missing Authorization vulnerability caused by incorrectly configured access control security levels, enabling unauthorized access. CVSS v3.1 base score is 5.3 (Medium). Red Hat and Patchs...

CVE-2024-7837

The CVE-2024-7837 entry concerns Firmanet Software ERP with an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. Affected are ERP versions prior to 22.11.2024. The vulnerability potentially allows unauthorized SQL execution, as described in multiple connect...

CVE-2022-20931

CVE-2022-20931 concerns Cisco TelePresence CE Software used on Cisco Touch 10 devices, where weak version control allows an unauthenticated, adjacent attacker to downgrade to an older software version. The root cause is insufficient version control in the software update flow, enabling installati...

Palo Alto Expedition 1.2.91 Remote Code Execution

class MetasploitModule 'Palo Alto Expedition Remote Code Execution CVE-2024-5910 and CVE-2024-9464', 'Description' = %q Obtain remote code execution in Palo Alto Expedition version 1.2.91 and below. The first vulnerability, CVE-2024-5910, allows to reset the password of the admin user, and the...

CVE-2024-10378 ESAFENET CDG CDGRenewApplicationService.java actionViewCDGRenewFile sql injection

A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile of the file /com/esafenet/servlet/client/CDGRenewApplicationService.java. The manipulation of the argument CDGRenewFileId leads to sql injection. It is possible to launch the...

CVE-2023-22649

Summary of CVE-2023-22649 (Rancher Audit Log leak) A vulnerability in Rancher Audit Logging may leak sensitive data into audit logs. Affected deployments are those using the opt-in Audit Logging feature with AUDIT_LEVEL set to 1 or higher. The issue could expose headers, credentials, and other se...

WordPress Advanced Custom Fields PRO plugin <= 6.3.7 - Administrator+ Limited Arbitrary Function Call vulnerability

Administrator+ Limited Arbitrary Function Call vulnerability discovered by Automattic Security Team in WordPress Plugin Advanced Custom Fields PRO versions = 6.3.7...

Proroute H685 4G router vulnerabilities

TL;DR Two vulnerabilities on the Proroute H685t-w 4G Router Authenticated command injection is possible through the admin interface Reflected Cross Site-Scripting is possible through the admin interface Patch any routers to revision 3.2.335 or higher Vulnerability 1: Command Injection on Proroute...

Multiple DVR Manufacturers Configuration Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multiple DVR Manufacturers Configuration Disclosure', 'Description' = %q This module takes advantage of an authentication bypass vulnerability at...

WordPress Ultimate CSV Importer User Table Extract

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'csv' class MetasploitModule 'WordPress Ultimate CSV Importer User Table Extract', 'Description' = %q Due to lack of verification of a visitor's permissions, it ...