PT-2024-40464 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: Drupal versions affected versions not specified Description: The issue is related to the use of the third-party library CKEditor in Drupal, which has a security improvement that protects against Cross Site Scripting XSS vulnerabilities. If...

WordPress plugin Alt Text AI 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-4676

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /view/rangegradetext.php. The manipulation of the argument count leads to cross site scripting. The attack may be initiated...

CVE-2024-4425

The access control in CemiPark software stores integration e.g. FTP or SIP credentials in plain-text. An attacker who gained unauthorized access to the device can retrieve clear text passwords used by the system.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vend...

CVE-2024-2923

The Magical Addons For Elementor Header Footer Builder, Free Elementor Widgets, Elementor Templates Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text effect widget in all versions up to, and including, 1.1.37 due to insufficient input sanitization and...

CVE-2024-0098

NVIDIA ChatRTX for Windows contains a vulnerability in the ChatRTX UI and backend, where a user can cause a clear-text transmission of sensitive information issue by data sniffing. A successful exploit of this vulnerability might lead to information disclosure...

WordPress Alt Text AI plugin <= 1.4.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin Download Alt Text AI versions = 1.4.9...

Campcodes Complete Web-Based School Management System 跨站脚本漏洞

Campcodes Complete Web-Based School Management System is a Web-based school management system from Campcodes, Inc. A cross-site scripting vulnerability exists in version 1.0 of the Campcodes Complete Web-Based School Management System, which originates from a cross-site scripting vulnerability in...

Alt Text AI – Automatically generate image alt text for SEO and accessibility < 1.5.0 - Authenticated (Subscriber+) SQL Injection

Description The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘lastpostid’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack...

WordPress Download Alt Text AI Plugin <= 1.4.9 is vulnerable to SQL Injection

Software Download Alt Text AI Type Plugin Vulnerable versions = 1.4.9 Fixed in 1.5.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4847 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 156a5d33530e Credits Lucio Sá Required privilege Subscriber...

Directus allows redacted data extraction on the API through "alias"

Summary A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the alias functionality on the API. Normally, these redacted fields will return however if we change the request to ?aliasworkaround=redacted we can instead retrieve the...

The vulnerability of Unitronics Vision’s microprogrammed logic controllers, related to the storage of passwords in a recoverable format, allows a hacker to obtain the “Information Mode” password in plain text.

The vulnerability of the microprogrammed logic controllers from Unitronics Vision relates to the storage of passwords in a recoverable format. Exploiting this vulnerability could allow an attacker, operating remotely, to obtain the “Information Mode” password in plain text...

The vulnerability of the User Plane Location (SUPL) message handler in the Telit Cinterion modem software allows a perpetrator to execute arbitrary code.

The vulnerability of the User Plane Location SUPL message handler in Telit Cinterion modem software is related to buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted SMS message...

RHEL 8 : golang.org_x_text (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag CVE-2020-28852 - The...

RHEL 8 : developer_environment (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Developer environment: Homoglyph characters can lead to trojan source attack CVE-2021-42694 - An issue wa...

RHEL 6 : thunderbird (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - thunderbird: Memory corruption when processing S/MIME messages CVE-2021-43529 - thunderbird: Crafted emai...

CVE-2024-4425

CVE-2024-4425 affects CemiPark software (versions 4.5, 4.7, 5.03 and potentially others). The root cause is improper handling of credentials, with integration credentials (e.g., FTP or SIP) stored in plain-text. An attacker who gains unauthorized access to the device can retrieve clear-text passw...

PT-2024-31076 · Cemipark · Cemipark

Name of the Vulnerable Software and Affected Versions: CemiPark software versions 4.5 through 5.03 Description: The access control in CemiPark software stores integration credentials, such as FTP or SIP, in plain-text. An attacker who gains unauthorized access to the device can retrieve clear tex...

PT-2024-30517 · WordPress · Rank Math Seo

Name of the Vulnerable Software and Affected Versions: Rank Math SEO with AI Best SEO Tools plugin for WordPress versions up to, and including, 1.0.217 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the...

PT-2024-22825 · WordPress · Magical Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Magical Addons For Elementor plugin versions up to, and including, 1.1.37 Description: The issue is related to Stored Cross-Site Scripting via the plugin's text effect widget due to insufficient input sanitization and output escaping on...