CVE-2023-52943

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors...

app.valuationcontrol:library (>=0.5.2 <=0.5.6), app.valuationcontrol:webservice (>=0.5.0 <=0.5.1) +2211 more potentially affected by CVE-2024-38827 via org.springframework.security:spring-security-core (>=6.2.0 <=6.2.7)

org.springframework.security:spring-security-core MAVEN version =6.2.0, =0.5.2, =0.5.0, =7.0.0, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.31 and more Source cves: CVE-2024-38827 Source advisory: OSV:GHSA-Q3V6-HM2V-PW99...

WordPress Out Of Stock Badge plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by SOPROBRO in WordPress Plugin Out Of Stock Badge versions = 2.0...

WordPress Fence URL plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Fence URL versions = 2.0.0...

WordPress Slick Sitemap plugin <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Slick Sitemap versions = 2.0.0...

PT-2024-31625 · Zoom · Zoom Apps

Name of the Vulnerable Software and Affected Versions: Zoom Apps versions prior to 6.2.0 Description: The issue involves improper input validation, allowing an unauthenticated user to conduct a denial of service attack via network access. This can be exploited by unauthenticated users to launch...

WordPress WordPress GDPR plugin <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin WordPress GDPR & CCPA versions = 2.0.2...

WordPress LGPD Framework plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin LGPD Framework versions = 2.0.2...

AZL-60907 CVE-2024-7730 affecting package qemu for versions less than 8.2.0-16

A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtiosndpcmincb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element...

WordPress plugin Global Gateway e4 | Payeezy Gateway 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A path traversal vulnerability exists in the WordPress plug...

WordPress Devexhub Gallery plugin <= 2.0.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Devexhub Gallery versions = 2.0.1...

Brokerage Wave 安全漏洞

Brokerage Wave is a frontend product from Brokerage, Inc. A security vulnerability exists in Brokerage Wave version 2.0, which stems from a lack of rate limiting for OTP requests in API endpoints, which could allow an attacker to cause OTP bombardment/flooding on the target system by sending...

KDE KMail 安全漏洞

KDE KMail is an email component in Kontact a personal information management suite from the KDE community. A security vulnerability exists in KDE KMail versions prior to 6.2.0 that stems from plaintext HTTP being used for URLs to retrieve configurations, which allows an attacker to trigger the us...

MangoOS 安全漏洞

MangoOS is an open source JavaScript object-oriented programming library from Automattic. A security vulnerability exists in MangoOS versions prior to 5.2.0, which stems from authenticated Remote Code Execution RCE via the Active Process Command feature...

CVE-2024-10180

The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fieldgroup shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

WordPress Futurio Extra plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Futurio Extra versions = 2.0.11...

Liferay Portal和Liferay DXP 跨站请求伪造漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DX...

CVE-2024-49230

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Harpreet Singh Ajax Custom CSS/JS allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through 2.0.4...

CVE-2024-9361

The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveconfiguration' function in all versions up to, and including, 2.0.1. This makes it possible for authenticate...

NEUMANN N-LINE 安全漏洞

NEUMANN N-LINE is an online course training tool for LIVE and recorded distribution from NEUMANN Japan. A security vulnerability exists in NEUMANN N-LINE version 2.0.6 and prior versions, which stems from improper input validation, where arbitrary code may be executed on a user's browser or may b...