CVE-2024-30157

Summary: CVE-2024-30157 affects Mitel MiCollab (Suite Applications Services component) up through version 9.7.1.110. An authenticated attacker with administrative privileges can exploit a SQL Injection due to improper input validation, potentially executing arbitrary database and management opera...

PT-2024-33578 · WordPress · Duplicate Title Validate

Name of the Vulnerable Software and Affected Versions: Duplicate Title Validate versions n/a through 1.0 Description: The issue is related to an SQL Injection vulnerability, specifically an improper neutralization of special elements used in an SQL command. This allows for Blind SQL Injection,...

CVE-2024-10118

SECOM WRTR-304GN-304TW-UPSC does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device...

CVE-2024-9264 Grafana SQL Expressions allow for remote code execution

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CVE-2024-9264

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-43800)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43800 advisory. - serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to...

PT-2024-32940 · Unknown · Restaurant Reservations Widget

Name of the Vulnerable Software and Affected Versions: Restaurant Reservations Widget versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations:...

Cisco Expressway Series Command Injection Vulnerability

Cisco Expressway Series is a software from Cisco USA for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters work more efficiently on the devices of their choice. A command injection vulnerability exists ...

CVE-2024-48918

RDS Light (pre-1.1.0) contains a validation gap in the user input handling code (main.py) of the Reflective Dialogue System (RDS) AI framework. The vulnerability allows injection and potential memory tampering through unvalidated inputs, with impact on confidentiality, integrity, and availability...

CVE-2024-20460

A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user. This vulnerability is due to insufficient validation of user input...

CVE-2024-20512 Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

CVE-2024-20512 Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

CVE-2024-20460 Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user. This vulnerability is due to insufficient validation of user input...

CVE-2024-20460 Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user. This vulnerability is due to insufficient validation of user input...

Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

PT-2024-7337 · Cisco · Cisco Unified Contact Center Management Portal

Name of the Vulnerable Software and Affected Versions: Cisco Unified Contact Center Management Portal Unified CCMP affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an...

CVE-2024-9971

The CVE-2024-9971 issue affects NewType’s FlowMaster BPM Plus. A flaw in the product’s specific query function fails to properly restrict user input, allowing SQL injection. This enables remote attackers with regular privileges to read, modify, or delete database contents. Documents cite a high-s...

CVE-2024-9971 NewType FlowMaster BPM Plus - SQL Injection

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9971 NewType FlowMaster BPM Plus - SQL Injection

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents...

CVE-2024-9969 NewType WebEIP v3.0 - Reflected XSS

NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting XSS attack. The affected product is no longer maintained. It is recommended to upgrade to the...