PT-2025-6266 · Fortinet · Fortiportal

Name of the Vulnerable Software and Affected Versions: FortiPortal versions 7.0.0 through 7.0.11 FortiPortal versions 7.2.0 through 7.2.6 FortiPortal versions 7.4.0 through 7.4.2 Description: An Improper Resolution of Path Equivalence issue may allow a remote unauthenticated attacker to retrieve...

CVE-2024-13440 Super Store Finder <= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting

The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssfwpusername’ parameter in all versions up to, and including, 7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

Ubuntu 16.04 LTS : PHP vulnerabilities (USN-7157-3)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7157-3 advisory. USN-7157-1 fixed vulnerabilities in PHP versions 7.4, 8.1, and 8.3. This update provides the corresponding updates for PHP version 7.0. Tenable has...

CVE-2024-46622

An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8.0.x before 8.0.18, and 8.1.x before 8.1.18 that allows arbitrary file creation, modification and deletion...

CVE-2024-56361 Stored Cross-Site Scripting (XSS) in lgsl v7.0

LGSL Live Game Server List provides online status for games. Before 7.0.0, a stored cross-site scripting XSS vulnerability was identified in lgsl. The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon...

CVE-2024-56361

LGSL (Live Game Server List) version before 7.0.0 is affected by a stored XSS vulnerability via the lgsl_query_40 HTTP crawler. The crawler requests the /info endpoint on registered game servers, and the payload is rendered on the info page (displayed through lgsl_details.php), enabling execution...

Drupal core 安全漏洞

Drupal core is a free, open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal core version 7.0 up to and including version 7.102, version 8.0.0 up to and including version 10.2.11, and version 10.3.0 up to and including version...

Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following: - Vulnerability in the Oracle Business Intelligence Enterprise Edition product o...

WordPress Twitter real time search scrolling Plugin <= 7.0 is vulnerable to Cross Site Scripting (XSS)

Software Twitter real time search scrolling Type Plugin Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51716 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ded87af36a1 Credits SOPROBRO Required...

MongoDB DoS Vulnerability (SERVER-92382) - Windows

MongoDB is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

Oracle VirtualBox Security Update (Oct 2024) - Windows

Oracle VirtualBox is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ManageEngine PAM360 < 7.0 Build 7001 SQLi

The remote host is running a version of ManageEngine PAM360 prior to 7.0 Build 7001. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or...

UBUNTU-CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

Security Bulletin: IBM Storage Ceph is vulnerable to a Heap-based Buffer Overflow in the RHEL UBI (CVE-2023-4911)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. CVE-2023-4911 Vulnerability Details CVEID:CVE-2023-4911 DESCRIPTION: glibc could allow a local authenticated attacker to gain elevate...

Ffmpeg copy_column buffer overflow vulnerability

FFmpeg is a complete solution for recording, converting and streaming audio and video from the FFmpeg team. A buffer overflow vulnerability exists in FFmpeg version 7.0, which stems from a boundary error in the copycolumn parameter of libavfilter/vftiltandshift.c:189:5 when handling untrusted...

PT-2024-8679 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: FFmpeg version 7.0 Description: The issue is related to a buffer overflow in the hevc frame end function of the FFmpeg library, located in libavcodec/hevcdec.c. This can lead to an out-of-bounds operation in memory, potentially allowing an...

BlackBerry QNX SDP Input Validation Error Vulnerability

BlackBerry QNX SDP is a software development platform from BlackBerry Canada BlackBerry. An input validation error vulnerability exists in BlackBerry QNX SDP versions 6.6, 7.0, and 7.1, which stems from the presence of an incorrect input validation vulnerability that could allow an attacker to...

CVE-2024-23793

The file upload feature in OTRS and OTRS Community Edition has a path traversal vulnerability. This issue permits authenticated agents or customer users to upload potentially harmful files to directories accessible by the web server, potentially leading to the execution of local code like Perl...

Fortinet Fortigate - Format String in CLI command (FG-IR-23-413)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-413 advisory. - A use of externally-controlled format string vulnerability CWE-134 in FortiOS version 7.4.1 and below, version 7.2.7 and...

MongoDB Server 输入验证错误漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. An input validation error vulnerability exists in MongoDB Server versions v7.0 through prior to...