phiola 安全漏洞

phiola is a fast audio player, recorder, and converter for Windows, Linux, and Android by Simon Zolin Personal Developer. A security vulnerability exists in phiola version v2.0-rc22, which stems from the presence of a buffer overflow vulnerability that could allow a remote attacker to execute...

CVE-2024-33766

lunasvg v2.3.9 was discovered to contain an FPE Floating Point Exception at blendtransformedtiledargb.isra.0...

libreswan: Missing PreSharedKey for connection can cause crash

A flaw was found in Libreswan. This issue causes Libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys authby=secret, and the connection cannot find a matching configured secret. When automatically added on startup using the auto= keyword,...

freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the nscrledecompressdata function. The Out-Of-Bounds Read occurs because it processes context-Planes without checking if it contains da...

WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Min and Max Purchase for WooCommerce versions = 2.0.0...

PT-2024-29596 · WordPress · Customer Email Verification For Woocommerce

Name of the Vulnerable Software and Affected Versions: Customer Email Verification for WooCommerce plugin for WordPress versions up to 2.7.4 Description: The issue concerns the Customer Email Verification for WooCommerce plugin for WordPress, which is vulnerable to email verification and...

Adive Framework 跨站脚本漏洞

Adive Framework is a PHP-based MySQL database management framework. A cross-site scripting vulnerability exists in Adive Framework version 2.0.8, which stems from a failure to adequately encode user-controlled input, leading to a cross-site scripting XSS vulnerability that allows an attacker to...

WordPress AJAX Login and Registration modal popup + inline form plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin AJAX Login and Registration modal popup + inline form versions = 2.23...

Telegram Web K 安全漏洞

Telegram Web K is a Webgram-based tool from the individual developer Eduard Kuzmenko. A security vulnerability exists in Telegram Web K versions prior to 2.0.0. An attacker exploited the vulnerability to perform cross-site scripting attacks...

GT3 Soluciones SWAL 跨站脚本漏洞

GT3 Soluciones SWAL is an application from GT3 Soluciones, Inc. A cross-site scripting vulnerability exists in GT3 Soluciones SWAL version 2.0 r2301, which stems from a reflected cross-site scripting XSS vulnerability in the Title parameter...

WordPress plugin Portfolio 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-41291

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version:...

WordPress Radio Station plugin <= 2.5.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Radio Station versions = 2.5.7...

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...

PT-2024-11774 · Fdupes +1 · Fdupes +1

Name of the Vulnerable Software and Affected Versions: FDUPES versions prior to 2.2.0 Description: A TOCTOU race condition in the deletefiles function allows for arbitrary file deletion via a symlink. Recommendations: For FDUPES versions prior to 2.2.0, update to version 2.2.0 or later to resolve...

Angular-translate 跨站脚本漏洞

angular-translate is an AngularJS module in the angular-translate open source. A cross-site scripting vulnerability exists in Angular-translate version 2.19.1 and earlier, which stems from allowing cross-site scripting attacks via a crafted key used by the Translate command...

CVE-2024-31574

Cross Site Scripting vulnerability in TWCMS v.2.6 allows a local attacker to execute arbitrary code via a crafted script...

Broadcom Brocade SANnav 安全漏洞

Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in Brocade SANnav versions prior to v2.2.0 that stems from exposing Kafka in the WAN interface, which could allow an unauthenticated attacker to perform various attacks...

TWCMS 安全漏洞

TWCMS is an enterprise website management system from China's Tong Wang CMS TWCMS company. A security vulnerability exists in TWCMS version v.2.6, which stems from the presence of a cross-site scripting XSS vulnerability...