CVE-2024-38765

Cross-Site Request Forgery CSRF vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through = 1.0.48...

CVE-2024-38754

Cross-Site Request Forgery CSRF vulnerability in Taggbox Taggbox taggbox-widget allows Cross Site Request Forgery.This issue affects Taggbox: from n/a through = 3.3...

CVE-2024-37240

Cross-Site Request Forgery CSRF vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through = 1.3.51...

CVE-2024-37473

CVE-2024-37473 describes a Cross-Site Request Forgery in the BlazeThemes Trendy News WordPress theme (“Trendy News”) affecting versions up to and including 1.0.15. The CVE entry is supported by multiple sources (NVD, RH, CVE lists) and has a CVSSv3.1 base score of 4.3 (Medium) with NETWORK attack...

CVE-2024-37272

CVE-2024-37272 is a CSRF vulnerability in the Travel Monster component of the Travel Monster/WP Travel Engine ecosystem. Public records indicate affected range up to version 1.1.2. CVSS score is 4.3 (3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/I:L/A:N). The connected sources confirm the vulnerability typ...

PT-2025-52554

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1:1.39.17-1deb12u1 MediaWiki versions prior to 1:1.43.6+dfsg-1deb13u1 Description Multiple security issues were identified in MediaWiki, a website engine used for collaborative work. These issues could lead to...

CVE-2024-13058

An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products such ...

BIT-RAILS-2024-26143 Rails Possible XSS Vulnerability in Action Controller

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "html", a :default key which contains untrusted user input, and th...

Apache Tomcat Uncontrolled Resource Consumption vulnerability

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at...

CVE-2024-54389

Cross-Site Request Forgery CSRF vulnerability in Eduardo addWeather myweather allows Cross Site Request Forgery.This issue affects addWeather: from n/a through = 2.5.1...

CVE-2024-54353

Cross-Site Request Forgery CSRF vulnerability in wpgear Hack-Info hack-info allows Stored XSS.This issue affects Hack-Info: from n/a through = 3.17...

BIT-NODE-MIN-2020-8252

The implementation of realpath in libuv 10.22.1, 12.18.4, and 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes...

GHSA-69PR-78GV-7C6H Mattermost Improper Validation of Specified Type of Input vulnerability

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side webapp and mobile DoS to users of particular channels, by sending a specially crafted post...

BIT-MATTERMOST-2024-2445

Mattermost Jira plugin versions shipped with Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to escape user-controlled outputs when generating HTML pages, which allows an attacker to perform reflected cross-site scripting attacks agains...

PT-2024-40643 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to an index-out-of-bounds crash. Technical details about the crash include the functions ndpi search dns, search dns again, and ndpi...

CVE-2024-54325

CVE-2024-54325 is a reflected cross-site scripting vulnerability in CarDealerPress (DealerTrend) that allows an attacker to inject malicious input which is reflected in the web page. The issue is caused by improper neutralization of input during web page generation, enabling likely an XSS payload...

PT-2024-36037 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns a Read/Write vulnerability in the image decoding module. Successful exploitation of this vulnerability will affect availability. Ther...

CVE-2024-55637

CVE-2024-55637 : Drupal Core contains a deserialization of untrusted data vulnerability, enabling an object injection gadget chain that can lead to remote code execution if the application deserializes data from untrusted sources via another vulnerability. Impact is described as high/critical whe...

CVE-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2024-54224

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a through = 6.4.7...