PYSEC-2024-301

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...

Electron-PDF Security Vulnerability

Electron-PDF is a powerful command line tool from the individual developers at Fraser Xu. A security vulnerability exists in Electron-PDF version 20.0.0, which stems from a failure to validate the HTML content of user input, allowing an attacker to obtain arbitrary local files...

The vulnerability in the implementation of the AVRCP protocol of the Bluetooth protocol stack for the Linux BlueZ operating system allows a hacker to execute arbitrary code with root privileges.

The vulnerability in the implementation of the AVRCP protocol of the Bluetooth protocol stack for the Linux BlueZ operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code with root privileges...

Pyhtml2pdf Cross-Site Scripting Vulnerability

Pyhtml2pdf is a simple python wrapper from the Python Foundation. Convert HTML to PDF using headless Chrome via selenium. A cross-site scripting vulnerability exists in Pyhtml2pdf version 0.0.6, which stems from not validating user-entered HTML content, resulting in an attacker being able to obta...

CVE-2023-50926 Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message...

CVE-2023-50926 Unvalidated DIO prefix info length in RPL-Lite in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message...

The vulnerability of the QuTS operating systems and QTS network devices from Qnap, related to an unvalidated return value, allows attackers to trigger a service failure.

The vulnerability of the QuTS operating systems and QTS network devices involves an unvalidated return value. Exploiting this vulnerability can allow attackers to cause service failures...

Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS

Description The plugin does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

mod_auth_openidc security vulnerability

modauthopenidc is a software application. It is an authentication/authorization module for the Apache 2.x HTTP server, used as an OpenID Connect dependency to authenticate users against the OpenID Connect provider. A security vulnerability exists in modauthopenidc versions 2.0.0 through 2.4.15.1,...

CVE-2023-6294

The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations...

AZL-35477 CVE-2024-1151 affecting package hyperv-daemons for versions less than 6.6.22.1-2

A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and causing a stack overflow. As a result,...

PT-2024-14221 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this issue, the existing authentication...

PT-2024-14224 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra version 7.5.0 Build 29 Description: This issue allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this issue, the product implements a...

PT-2024-14530 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this issue, the product implements ...

PT-2024-19673 · Centreon · Centreon

Name of the Vulnerable Software and Affected Versions: Centreon affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this issue. The specific flaw exists within the...

CVE-2024-0366

The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This makes it possible for subscribers to view plugin preferences...

OpenEX Buffer Overflow Vulnerability

OpenEXR is an open standard for high dynamic range image HDR file formats. A buffer overflow vulnerability exists in OpenEXR 3.2.1 and prior versions that stems from an inability to validate the number of scanline samples that contain deep scanline data. An attacker could exploit this vulnerabili...

Arbitrary Command Injection

network is vulnerable to Arbitrary Command Injection. The vulnerability is due to use of the childprocess.exec function without command sanitization. This allows an attacker to execute arbitrary OS commands through macaddressfor function...

PT-2024-16155 · Sourcecodester · Sourcecodester Facebook News Feed Like

Name of the Vulnerable Software and Affected Versions: SourceCodester Facebook News Feed Like version 1.0 Description: A vulnerability has been found in the Post Handler component, allowing for cross-site scripting. The issue arises from the manipulation of the Description argument with malicious...

The vulnerability of the Mozilla Firefox browser, related to an unvalidated return value, allows a hacker to trigger a service failure.

The vulnerability of the Mozilla Firefox browser is related to an unvalidated return value. Exploiting this vulnerability can allow a remote attacker to cause a service failure...