281 matches found
PT-2024-17845 · Unknown · Phpgurukul Blood Bank & Donor Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Blood Bank & Donor Management System version 2.4 Description: A problem has been found in the system, affecting some unknown functionality of the file /bbdms/admin/update-contactinfo.php. The manipulation of the Address argument...
CVE-2024-12955
A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as problematic. This vulnerability affects unknown code of the file /logout.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been...
WordPress Feedify – Web Push Notifications plugin <= 2.4.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Feedify – Web Push Notifications versions = 2.4.2...
WordPress Seraphinite Bulk Discounts for WooCommerce plugin <= 2.4.6 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Colin Xu in WordPress Plugin Seraphinite Bulk Discounts for WooCommerce versions = 2.4.6...
SFTPGo 输入验证错误漏洞
SFTPGo is a full-featured and highly configurable SFTP server from the individual developer Nicola Murino in Italy. An input validation error vulnerability exists in SFTPGo versions prior to 2.4.0 through 2.6.3, which stems from the ability of an administrator to access the underlying operating...
PT-2024-35313 · Unknown · Html5 Lyrics Karaoke Player
Name of the Vulnerable Software and Affected Versions: HTML5 Lyrics Karaoke Player versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...
WordPress HTML5 Lyrics Karaoke Player plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin HTML5 Lyrics Karaoke Player versions = 2.4...
PT-2024-39641 · WordPress · Embed Pdf Viewer
Name of the Vulnerable Software and Affected Versions: Embed PDF Viewer plugin for WordPress versions up to, and including, 2.4.4 Description: The issue is related to Stored Cross-Site Scripting via the height and width parameters due to insufficient input sanitization and output escaping. This...
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10 the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
...
WordPress Parabola theme <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Parabola versions = 2.4.1...
Magento Improper Authorization leads to Security feature bypass
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information...
Bylancer Quicklancer SQL注入漏洞
Bylancer Quicklancer is a freelance platform from Bylancer, Inc. A SQL injection vulnerability exists in Bylancer Quicklancer version 2.4, which stems from the parameter range2 of the component GET Parameter Handler can lead to SQL injection...
CVE-2024-4455
The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
WordPress FooGallery plugin <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Image Attachment Fields vulnerability discovered by Tim Coen in WordPress Plugin FooGallery versions = 2.4.14...
CVE-2023-41284
A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.4 and later...
CVE-2023-3701
Aqua Drive, in its 2.4 version, is vulnerable to a relative path traversal vulnerability. By exploiting this vulnerability, an authenticated non privileged user could access/modify stored resources of other users. It could also be possible to access and modify the source and configuration files o...
CVE-2023-37891
Cross-Site Request Forgery CSRF vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin = 2.0.4 versions...
PT-2023-28968 · WordPress · Saso Serial Codes Generator/Validator With Woocommerce Support
Name of the Vulnerable Software and Affected Versions: Serial Codes Generator and Validator with WooCommerce Support WordPress plugin versions prior to 2.4.15 Description: The issue concerns the Serial Codes Generator and Validator with WooCommerce Support WordPress plugin, where some settings ar...
ArgoCD Resource Management Error Vulnerability
ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...