PT-2024-21093 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions prior to 11.2 Description: The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to provide input that is not sanitized properly and is rendered in error...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome versions prior to 123.0.6312.105, which stems from the presence of a post-release reuse vulnerability...

AZL-58746 CVE-2024-26718 affecting package kernel for versions less than 5.15.176.3-3

In the Linux kernel, the following vulnerability has been resolved: dm-crypt, dm-verity: disable tasklets Tasklets have an inherent problem with memory corruption. The function taskletactioncommon calls tasklettrylock, then it calls the tasklet callback and then it calls taskletunlock. If the...

VeridiumID 安全漏洞

VeridiumID is an integrated passwordless platform from VeridiumID. A security vulnerability exists in VeridiumID versions prior to 3.5.0. An attacker exploited the vulnerability to take over a victim's account by registering its FIDO authenticator to that account...

OpenHarmony 安全漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony prior to version v4.0.0. A local attacker exploiting the vulnerability could execute arbitrary code via out-of-bounds...

SAMSUNG SmartThings 安全漏洞

SAMSUNG SmartThings is an application from Samsung South Korea that connects smart devices. A security vulnerability exists in SAMSUNG SmartThings versions prior to 1.8.13.22, which stems from improper data validation by the broadcast receiver...

WordPress WooCommerce Product Filter plugin < 1.4.4 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Themify – WooCommerce Product Filter versions 1.4.4...

PT-2024-19508 · WordPress · Themify

Name of the Vulnerable Software and Affected Versions: Themify WordPress plugin versions prior to 1.4.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-40548 · Kanidm · Kanidm

Name of the Vulnerable Software and Affected Versions: kanidm versions prior to 1.1.0rc16git6.e51d0de Description: The issue is related to an administrator-triggered thread crash in oauth2 claim maps. This problem can be triggered by an administrator, leading to a thread crash. There is no...

Algoritimk E-commerce Software 跨站脚本漏洞

Algoritimk E-commerce Software is an e-commerce platform software from Algoritimk. A cross-site scripting vulnerability exists in Algoritimk E-commerce Software versions prior to 3.9.2, which stems from improper neutralization of user input...

PT-2024-14862

Name of the Vulnerable Software and Affected Versions Algoritim E-commerce Software versions prior to 3.9.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can injec...

CVE-2024-29228

Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain sensitive information via unspecified vectors...

Opswat Metadefender Core 安全漏洞

OPSWAT MetaDefender Core OPSWAT MDCore is a multi-engine anti-malware software from OPSWAT, Inc. It prevents the upload of malicious files on web applications that bypass sandboxing and other detection-based security solutions. A security vulnerability exists in Opswat Metadefender Core versions...

JupyterHub 跨站脚本漏洞

JupyterHub is a multi-user server for Jupyter. A security vulnerability exists in JupyterHub versions prior to 4.1.0, which stems from a vulnerability that allows an attacker to directly impact a user's session by tricking the user into visiting a malicious subdomain...

DEBIAN-CVE-2024-2887

Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

PT-2024-18267 · Oracle · Sqlplus

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0b4 beta, 2.2.0p24, 2.1.0p41 and 2.0.0 EOL Description: The invocation of the sqlplus command with sensitive information in the command line in the mk oracle Checkmk agent plugin allows the extraction of this...

UBUNTU-CVE-2024-29943

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox 124.0.1...

Delta Electronics DIAEnergie SQL注入漏洞

Delta Electronics DIAEnergie is an industrial energy management system from Delta Electronics, Taiwan, China, for monitoring and analyzing energy consumption in real time, calculating energy consumption and load characteristics, optimizing equipment performance, improving production processes and...

Umbraco 安全漏洞

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco versions prior to 10.8.4, which stems from vulnerability to user enumeration attacks...

CVE-2024-1658

The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...