CVE-2024-53647

Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service...

Fields GLPI plugin 安全漏洞

Fields GLPI plugin is an open source plugin for GLPI Project Plugins. A security vulnerability exists in the Fields GLPI plugin version 3.0.0 through versions prior to 3.0.3, which stems from an inadequate security check that allows an unauthenticated attacker to determine if data with a specific...

djoser 安全漏洞

djoser is a REST implementation of the Django authentication system open-sourced by Sunscrapers. A security vulnerability exists in djoser versions prior to 2.3.0, which stems from the system directly querying the database to grant access to users with valid credentials, making it susceptible to ...

PT-2024-35690 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.0 Splunk Enterprise versions prior to 9.2.4 Splunk Enterprise versions prior to 9.1.7 Splunk Cloud Platform versions prior to 9.1.2312.206 Description: A low-privileged user without the "admin" or "powe...

BYD Dilink Headunit System 安全漏洞

BYD Dilink Headunit System is an in-vehicle operating system of the Chinese company BYD BYD. A security vulnerability exists in BYD Dilink Headunit System version v3.0 to v4.0. An attacker can exploit the vulnerability to bypass authentication via brute force attack...

WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Ni CRM Lead versions = 1.3.0...

HoDoKu 安全漏洞

HoDoKu is HoDoKu open source a Sudoku generator/solver/analyzer written in Java. A security vulnerability exists in HoDoKu versions v2.3.0 through v2.3.2, which stems from the presence of insecure deserialization that allows an attacker to execute arbitrary code...

WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability

Nonce Leakage to Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin FloristPress versions = 7.3.0...

SFTPGo 加密问题漏洞

SFTPGo is a full-featured and highly configurable SFTP server from the individual developer Nicola Murino in Italy. An encryption issue vulnerability exists in SFTPGo versions 2.3.0 through prior to 2.6.4, which stems from a vulnerability that allows an authenticated user to brute-force break a...

OpsManage 代码问题漏洞

OpsManage is a code deployment, application deployment, scheduled tasks, and device asset management platform by William.Cao Personal Developer. A code issue vulnerability exists in OpsManage. An attacker exploiting this vulnerability could cause data deserialization. The following versions are...

DedeBIZ 安全漏洞

DedeBIZ is a content management system from China Muyun Intelligence DedeBIZ company. A security vulnerability exists in DedeBIZ version v6.3.0, which stems from the presence of an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a carefully craft...

CVE-2024-10825

The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress Aqua SVG Sprite plugin <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Aqua SVG Sprite versions = 3.0.14...

WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin The Novel Design Store Directory versions = 4.3.0...

Enel X Waybox 安全漏洞

The Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox that stems from the fact that the TCF proxy service can be used to gain administrator privileges on the Waybox system...

WordPress WP Visual Adverts plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WP Visual Adverts versions = 2.3.0...

CVE-2024-10469

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users...

UBUNTU-CVE-2024-49767

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parse multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...

Apache Syncope 跨站脚本漏洞

Apache Syncope is an open source digital identity management system from the Apache USA Foundation for use in enterprise environments. The system supports identity management, role configuration, and more. A cross-site scripting vulnerability exists in Apache Syncope versions 2.1.X through 2.1.14...

WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability

Broken Access Control to Notice Dismissal vulnerability discovered by Marek Mikita Patchstack Alliance in WordPress Plugin Photo Gallery Builder versions = 3.0...