PT-2024-20476 · Allegro Ai · Clearml

Name of the Vulnerable Software and Affected Versions: Allegro AI's ClearML platform affected versions not specified Description: A cross-site scripting XSS vulnerability in the web server component of Allegro AI's ClearML platform allows a remote attacker to execute a JavaScript payload when a...

7 Sticky Notes v1.9 - OS Command Injection Vulnerability

Exploit Title: 7 Sticky Notes v1.9 - OS Command Injection Discovered by: Ahmet Ümit BAYRAM Vendor Homepage: http://www.7stickynotes.com Software Link: http://www.7stickynotes.com/download/Setup7StickyNotesv19.exe Tested Version: 1.9 latest Tested on: Windows 2019 Server 64bit Steps to Reproduce...

CVE-2024-0665

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-0665 WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2024-15731 · WordPress · Wp Customer Area

Name of the Vulnerable Software and Affected Versions: WP Customer Area plugin for WordPress versions up to, and including, 8.2.1 Description: The issue is related to Reflected Cross-Site Scripting via the tab parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2023-5081

An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier...

CVE-2023-5081

An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier...

Information disclosure

An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier...

CVE-2023-5081

An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier...

CVE-2023-5081

An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier...

CVE-2023-5081

CVE-2023-5081 describes an information-disclosure vulnerability in Lenovo Tab M8 HD where a local application could obtain a non-resettable device identifier. The NVD/NIST entry provides a CVSSv3.1 base score of 3.3 (Low) with LOCAL attack vector, minimal privileges, no user interaction, and conf...

Lenovo Tab M8 HD Information Disclosure Vulnerability

Lenovo Tab M8 HD is a thin and light tablet computer from Chinese company Lenovo. The Lenovo Tab M8 HD suffers from an information disclosure vulnerability that originates from allowing native applications to collect device identifiers that cannot be reset...

PHPJabbers Event Ticketing System 1.0 Missing Rate Limiting

Exploit Title: PHPJabbers Event Ticketing System v1.0 - No Rate Limit Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/meeting-room-booking-system/sectionDemo Version: v1.0 Tested on...

WordPress Plugin LearnPress Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-1556 · Lenovo · Lenovo Tab M8 Hd

Name of the Vulnerable Software and Affected Versions: Lenovo Tab M8 HD affected versions not specified Description: An information disclosure issue was reported, allowing a local application to gather a non-resettable device identifier. This could potentially enable an attacker to disclose...

PageLayer < 1.8.0 - Author+ Stored XSS

Description The plugin doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfilteredhtml is disallowed, such as in multi-site WordPress configurations. - As a user with Author+ capabilities, create a new pos...

Sql injection

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the AdministrationWidget tab after the login portal...

CVE-2023-6268

The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-6268

The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-32583 · WordPress · Json Content Importer

Name of the Vulnerable Software and Affected Versions: JSON Content Importer WordPress plugin versions prior to 1.5.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the tab parameter is not properly sanitized and escaped before being outputted bac...