UBUNTU-CVE-2024-1329

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...

CVE-2023-6676

Cross-Site Request Forgery CSRF vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This issue affects CyberMath: from v1.4 before v1.5...

CVE-2023-6673

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in National Keep Cyber Security Services CyberMath allows Reflected XSS.This issue affects CyberMath: from v.1.4 before v.1.5...

CVE-2023-6672

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in National Keep Cyber Security Services CyberMath allows Stored XSS.This issue affects CyberMath: from v1.4 before v1.5...

National Keep CyberMath Cross-Site Scripting Vulnerability

National Keep CyberMath is a cybersecurity risk analysis tool for organizations from National Keep. A cross-site scripting vulnerability exists in National Keep CyberMath versions v1.4 through v1.5 that stems from improper input neutralization during web page generation, resulting in a stored...

PT-2024-19248 · Unknown · Bradley B. Dalina Image Tag Manager

Name of the Vulnerable Software and Affected Versions: Bradley B. Dalina Image Tag Manager versions n/a through 1.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2024-12440 · Splicecom · Splicecom Maximiser Soft Pbx

Name of the Vulnerable Software and Affected Versions: SpliceCom Maximiser Soft PBX versions 1.5 and before Description: The issue allows attackers to bypass authentication via a brute force attack due to the lack of restriction on excessive authentication attempts. Recommendations: For SpliceCom...

PT-2024-12439 · Splicecom · Splicecom Maximiser Soft Pbx

Name of the Vulnerable Software and Affected Versions: Splicecom Maximiser Soft PBX versions 1.5 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the CLIENT NAME and DEVICE GUID fields in the login component...

WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Image Tag Manager Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-22160 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 21a3315fa407 Credits Dimas Maulana Required...

CVE-2023-28930

Cross-Site Request Forgery CSRF vulnerability in Robin Phillips Mobile Banner plugin = 1.5 versions...

CVE-2023-46776

A vulnerability in J0SiE Auto Excerpt everywhere auto-excerpt-everywhere.This issue affects Auto Excerpt everywhere: from n/a through = 1.5...

CVE-2023-46776

Cross-Site Request Forgery CSRF vulnerability in Serena Villa Auto Excerpt everywhere plugin = 1.5 versions...

apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

WordPress Current Menu Item for Custom Post Types Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Current Menu Item for Custom Post Types Type Plugin Vulnerable versions = 1.5 Fixed in 1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46781 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID eea8363457b5 Credits...

WordPress Auto Excerpt everywhere Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Auto Excerpt everywhere Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46776 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 813fdb38dc11 Credits Nguyen Xuan Chi...

mee-admin Path Traversal Vulnerability

mee-admin is an open source backend management system for funnyzpc individual developers. mee-admin 1.5 version of a security vulnerability , the vulnerability stems from the CommonFileController.java file in the download method does not validate the incoming data , resulting in arbitrary file re...

ELSYS ERS Security Vulnerability

ELSYS ERS is a smart, professional LoRaWAN sensor from ELSYS. It is used for indoor climate measurements. A security vulnerability exists in ELSYS ERS version 1.5 Sound v2.3.8, which stems from a buffer overflow vulnerability in the NFC data parser...

SEMCMS SQL Injection Vulnerability (CNVD-2023-62957)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 1.5 suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the parameter id of /AntSuxin.php, which can be exploited b...

Moxa NPort IA5150A/IA5250A Series Improper Access Control (CVE-2020-27149)

By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with Read Only privilege level can send requests via the web console to have the device's configuration changed. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

SEMCMS SQL注入漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS version 1.5 suffers from a SQL injection vulnerability, which originates from the lack of validation of external input SQL statements in the parameter id of /AntSuxin.php, which can be exploited b...