CVE-2024-5960

Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.This issue affects Panel: before v2.3.24...

CVE-2024-5959

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Eliz Software Panel allows Stored XSS.This issue affects Panel: before v2.3.24...

QNAP QuMagie 信任管理问题漏洞

QNAP Systems QuMagie is a QTS photo management application from China Weilian Technology QNAP Systems. A trust management issue vulnerability exists in QNAP QuMagie version 2.3.1 and prior versions, which stems from the inclusion of an incorrect certificate validation vulnerability. An attacker w...

PT-2024-40507 · Diesel · Diesel

Name of the Vulnerable Software and Affected Versions: Diesel versions prior to 2.2.3 Description: The issue concerns a SQL injection vulnerability that can be exploited by encoding a value larger than 4GiB, causing the length prefix in the protocol to overflow. This can lead to the server...

CVE-2024-43145

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61...

WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Void Elementor Post Grid Addon for Elementor Page builder versions = 2.3...

PT-2024-5814 · Dovecot +10 · Dovecot Imap Server +10

Name of the Vulnerable Software and Affected Versions: Dovecot IMAP Server versions 2.2 through 2.3.20 Description: The issue is related to the excessive CPU usage caused by a large number of address headers in emails, which can be exploited by external actors to consume system resources and caus...

PT-2024-29436 · Feripro · Feripro

Name of the Vulnerable Software and Affected Versions: Feripro versions prior to 2.2.3 Description: The issue concerns an Incorrect Access Control vulnerability. It affects the "/admin/programm//export/statistics" endpoint, allowing remote attackers to export an XLSX file containing information...

AZL-73323 CVE-2023-39327 affecting package openjpeg2 2.3.1-12

A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal...

WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme OnePress versions = 2.3.8...

AZL-44982 CVE-2023-39328 affecting package openjpeg2 2.3.1-12

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file...

PT-2024-28324 · Unknown · Cahil/Utils

Name of the Vulnerable Software and Affected Versions: cahil/utils version 2.3.2 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties using the set function. This is a result of prototype pollution in the cahil/utils...

CVE-2024-36684

In the module "Custom links" pkcustomlinks = 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection...

DEBIAN-CVE-2024-36600

Buffer Overflow Vulnerability in libcdio 2.2.0 fixed in 2.3.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file...

AZL-42592 CVE-2024-35235 affecting package cups for versions less than 2.3.3op2-9

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the...

WordPress plugin MegaMenu path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-35737

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Loopus WP Visitors Tracker allows Reflected XSS.This issue affects WP Visitors Tracker: from n/a through 2.3...

CVE-2024-35356

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /classes/Master.php?f=saveitem. Manipulating the argument id can result in SQL injection...

Dino Physics School Assistant SQL Injection Vulnerability

Dino Physics School Assistant is an application. A SQL injection vulnerability exists in Dino Physics School Assistant version 2.3, which stems from unrecognized code in /classes/Master.php that causes SQL injection via the parameter id...

Dino Physics School Assistant Cross-Site Scripting Vulnerability

Dino Physics School Assistant is an application. A cross-site scripting vulnerability exists in Dino Physics School Assistant version 2.3, which stems from unrecognized code in /classes/Users.php that leads to a cross-site scripting attack via the parameter id...