2683 matches found
CVE-2024-32048
Improper input validation in the IntelR Distribution of OpenVINOTM Model Server software before version 2024.0 may allow an unauthenticated user to potentially enable denial of service via adjacent access...
CVE-2024-23198
Improper input validation in firmware for some IntelR PROSet/Wireless Software and IntelR KillerTM Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access...
CVE-2024-23198
Improper input validation in firmware for some IntelR PROSet/Wireless Software and IntelR KillerTM Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access...
CVE-2024-10685
The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2024-52286 Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input file name and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code...
Exception unhandled, lead to server crash
Description In node js express, if exception is uncaught, the server will crash. fs module sometimes throw exception when dealing with file upload. Unauth user can send something to the server trigger the exception lead to server crash. Proof of Concept import requests import random import string...
PT-2024-16429 · WordPress · Ws Form Lite
Name of the Vulnerable Software and Affected Versions: WS Form LITE – Drag & Drop Contact Form Builder for WordPress versions up to, and including, 1.9.244 Description: The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the UR...
CVE-2024-51739
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...
CVE-2024-51739
CVE-2024-51739 affects Combodo iTop. Unauthenticated access via REST endpoint (webservices/rest.php) enables user enumeration through do_reset_pwd, exposing whether a user exists and aiding brute-force attempts. Descriptions in multiple sources confirm the issue stems from password-reset feedback...
CVE-2024-51739 Users enumeration allowed through Rest API in Combodo iTop
Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in...
SmartAgent 1.1.0 Server-Side Request Forgery
Exploit Title: SmartAgent v1.1.0 - Server-Side Request Forgery SSRF Date: 01-10-2024 Exploit Author: Alter Prime Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com Version: Build v1.1.0 Tested on: Kali Linux An unauthenticated user can trigger the web server to perform web reques...
PT-2024-39256
Name of the Vulnerable Software and Affected Versions: Subscribe to Comments plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...
VulnCheck KEV: CVE-2024-21894
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution...
CVE-2024-8924
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners...
CVE-2024-8923
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided th...
CVE-2024-8923
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided th...
CVE-2024-8924 Unauthenticated Blind SQL Injection in Core Platform
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners...
CVE-2024-8924
CVE-2024-8924 concerns ServiceNow Now Platform with an unauthenticated blind SQL injection vulnerability. The issue affects the Now Platform and could enable an attacker to extract unauthorized information. ServiceNow has deployed updates to hosted instances and provided fixes to partners and sel...
CVE-2024-45309 OneDev vulnerable to arbitrary file reading for unauthenticated user
OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9...
