Grist 跨站脚本漏洞

Grist is a modern relational spreadsheet open-sourced by Grist. A cross-site scripting vulnerability exists in Grist versions prior to 1.3.2, which stems from a JavaScript in an SVG file that can be executed in the context of the user's current page, thereby compromising the account of a user who...

CVE-2024-10244

CVE-2024-10244 affects ISDO Software Web Software. The issue is an SQL Injection caused by improper neutralization of special elements in the web app, exploitable remotely (NETWORK) with no user interaction. Affected versions are Web Software prior to 3.6. Impact per metrics is high/critical (C/H...

CVE-2024-10244 SQLi in ISDO Software's Web Software

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6...

PT-2024-40967 · Libafl · Libafl

Name of the Vulnerable Software and Affected Versions: LibAFL versions prior to 0.11.2 Description: The issue arises from the misuse of the slice::from raw parts mut API, where a pointer is misaligned due to a direct cast from u8 to u16 raw pointer, leading to unsound behavior. The problem is...

CVE-2024-56047

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS allows SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.5.3...

CVE-2024-56050

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a before 1.9.9.5.3...

CVE-2024-56053 WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through 1.9.9.5.3...

GHSA-V9MX-4PQQ-H232 Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects...

PT-2024-36268 · Boldthemes · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: Bold Page Builder versions prior to 5.1.5 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows for Path Traversal in BoldThemes Bold Page Builder...

PT-2024-17310 · WordPress · Glomex Oembed Plugin

Name of the Vulnerable Software and Affected Versions: glomex oEmbed plugin for WordPress versions prior to 0.9.1 Description: The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's glomex integration shortcode due to insufficient input sanitization a...

PT-2024-17296 · WordPress · Koalendar – Events & Appointments Booking Calendar

Name of the Vulnerable Software and Affected Versions: Koalendar – Events & Appointments Booking Calendar plugin for WordPress versions prior to 1.0.3 Description: The issue is related to Stored Cross-Site Scripting via the height parameter due to insufficient input sanitization and output...

Menlo Security On-Premise 安全漏洞

Menlo Security On-Premise is a secure enterprise browser-native program from Menlo Security. A security vulnerability exists in Menlo Security On-Premise versions prior to 2.88 that stems from the possibility that Web policies may not always be applied correctly to intentionally misformatted clie...

CVE-2024-9641 LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SiYuan 路径遍历漏洞

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A path traversal vulnerability exists in SiYuan versions prior to 3.1.16, which stems from vulnerability to arbitrary file read attacks via path traversal...

PT-2025-35160 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.2 Description: The issue involves improved memory handling. Parsing a maliciously crafted file may lead to unexpected application termination. Recommendations: Update to macOS version 15.2 to resolve the issue...

GStreamer 缓冲区错误漏洞

GStreamer is a GStreamer open source set of frameworks for processing streaming media. A buffer error vulnerability exists in versions of GStreamer prior to 1.24.10 that stems from reading the namelength value directly from an input file without properly checking it, resulting in an integer...

WordPress plugin LA-Studio Element Kit for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-55560

CVE-2024-55560 affects MailCleaner versions before 28d913e, where the default SSH host keys (ssh_host_dsa_key, ssh_host_rsa_key, ssh_host_ed25519_key) persist after installation. The underlying issue is the continued presence of these default keys, which can enable unauthorized access to the devi...

Dell Wyse Management Suite < 4.4.1 Multiple Vulnerabilities (DSA-2024-440)

The version of Dell Wyse Management Suite installed on the remote host is prior to 4.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2024-440 advisory. - Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions prior to 4.4.8. An attacker exploiting this vulnerability could execute a cross-site scripting attack...