SOPlanning 跨站脚本漏洞

SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.45 that stems from improper input validation and allows a remote user to send a specially crafted query to steal session details from...

CVE-2024-41514

A reflected cross-site scripting XSS vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "wer" parameter...

Shilpi Client Dashboard 安全漏洞

Shilpi Client Dashboard is a centralized dashboard from Shilpi. A security vulnerability exists in Shilpi Client Dashboard versions prior to 9.7.0, which stems from a lack of limitations on incorrect login attempts for API logins, which could lead to unauthorized access to other user accounts...

PT-2024-37596 · Unknown · Finrota Netahsilat

Name of the Vulnerable Software and Affected Versions: Finrota Netahsilat versions prior to 1.24.03 Description: The issue concerns a Cleartext Storage of Sensitive Information vulnerability, allowing the retrieval of embedded sensitive data. This vulnerability has been exploited to compromise us...

OpenC3 COSMOS 路径遍历漏洞

OpenC3 COSMOS is an OpenC3 open source application. A path traversal vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to download any .txt file by running ScreensControllershow on the web server...

PT-2024-7793

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 131 Description A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This issue may allow a remote attacker to conduct...

CVE-2023-52947

Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logo...

Talent BAP Automation 跨站脚本漏洞

Talent BAP Automation is an application from Talent, Inc. A cross-site scripting vulnerability exists in Talent BAP Automation versions prior to 30840, which stems from improper input neutralization during web page generation, making it susceptible to stored cross-site scripting attacks...

Grafana Alloy 安全漏洞

Grafana Alloy is an open source OpenTetry Collector distribution of Grafana Open Source. A security vulnerability exists in Grafana Alloy versions prior to 1.3.3 that stems from an unquoted search path or element vulnerability that allows elevation of privilege...

AZL-49740 CVE-2024-42861 affecting package linuxptp for versions less than 3.1.1-1

An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted PdelayReq message to the time synchronization function...

CVE-2024-47159

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project...

VulnCheck KEV: CVE-2015-3897

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource...

Dragonfly 安全漏洞

Dragonfly is a framework that allows dynamic processing of any content type. A security vulnerability exists in Dragonfly prior to version 2.0.9 that stems from Dragonfly's use of hard-coded JWT to authenticate users, which could lead to authentication bypass...

PT-2024-9895 · Glpi +1 · Fields Plugin +1

Name of the Vulnerable Software and Affected Versions: Fields plugin for GLPI versions prior to 1.21.13 Description: The issue is related to a lack of protection against SQL injection attacks in the Fields plugin for GLPI. This allows an authenticated user to perform a SQL injection when the plug...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in versions prior to Backstage 1.10.13 that stems from the possibility of accessing the contents of an entire storage bucket when using AWS S3 or GCS...

CVE-2024-6401

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SFS Consulting InsureE GL allows SQL Injection. This issue affects InsureE GL: before 4.6.2...

Concrete CMS 安全漏洞

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A security vulnerability exists in Concrete CMS versions 9.0.0 through 9.3.3 and prior to 8.5.18, which stems from improper output cleanup, resulting in a malicious payload that can be executed in...

MISP 安全漏洞

MISP is an open source software solution from MISP Open Source. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.198...

WordPress CM Pop-Up Banners for WordPress plugin < 1.7.3 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Eunho Kim in WordPress Plugin CM Pop-Up banners versions 1.7.3...

Vidco VOC TESTER 路径遍历漏洞

Vidco VOC TESTER is a process management software from Vidco. A path traversal vulnerability exists in Vidco VOC TESTER versions prior to 12.34.8, which stems from an improper restriction on path names that allows path traversal...