Zyxel NAS542和NAS326 操作系统命令注入漏洞

Zyxel NAS542 and Zyxel NAS326 are both products of the Chinese company Hopkins Zyxel.Zyxel NAS542 is a NAS Network Attached Storage device.Zyxel NAS326 is a cloud storage NAS. An operating system command injection vulnerability exists in Zyxel NAS326 version V5.21AAZF.18C0 and earlier and NAS542...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

PT-2024-31222 · Autocms · Autocms

Name of the Vulnerable Software and Affected Versions: AutoCMS version 5.4 Description: The issue allows attackers to execute arbitrary PHP code via injecting a crafted value into the txtsite url parameter at the "/admin/site add.php" API endpoint. This enables attackers to inject malicious PHP...

AutoCMS 安全漏洞

AutoCMS is a content management system CMS from AutoCMS Open Source. It can help dealerships manage their website content, online advertising, social media and analytics. AutoCMS version 5.4 suffers from a SQL injection vulnerability that originates from the lack of validation of externally enter...

za-internet C-MOR Video Surveillance 安全漏洞

za-internet C-MOR Video Surveillance is a network video surveillance system from the German company za-internet. A security vulnerability exists in za-internet C-MOR Video Surveillance version 5.2401, which stems from improper input validation leading to reflective cross-site scripting...

PT-2024-31454 · Za Internet · Za-Internet C-Mor Video Surveillance

Name of the Vulnerable Software and Affected Versions: za-internet C-MOR Video Surveillance version 5.2401 Description: An issue was discovered due to improper or missing access control, allowing low privileged users to use administrative functions of the C-MOR web interface. Although different...

PT-2024-25269 · Espressif · Esp-Idf

Name of the Vulnerable Software and Affected Versions: esp-idf version 5.1 Description: A Buffer Overflow issue allows a remote attacker to obtain sensitive information via the externalId component. Recommendations: For esp-idf version 5.1, at the moment, there is no information about a newer...

MingSoft MCMS 安全漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingFei MingSoft. A security vulnerability exists in MingSoft MCMS version v5.4.1, which stems from improper handling of the front-end file upload function, and could lead to remote command execution...

PT-2024-36053 · Zyxel · Zyxel Vmg8825-T50K

Name of the Vulnerable Software and Affected Versions: Zyxel VMG8825-T50K firmware version 5.50ABOM.8C0 Description: A buffer overflow vulnerability in the library "libclinkc" could allow an unauthenticated attacker to cause denial of service DoS conditions by sending a crafted HTTP request to a...

OESA-2024-2082 tpm2-tools security update

The package contains the code for the TPM Trusted Platform Module 2.0 tools based on tpm2-tss. Security Fixes: tpm2-tools is the source repository for the Trusted Platform Module TPM2.0 tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This...

OESA-2024-2083 tpm2-tools security update

The package contains the code for the TPM Trusted Platform Module 2.0 tools based on tpm2-tss. Security Fixes: tpm2-tools is the source repository for the Trusted Platform Module TPM2.0 tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This...

CVE-2024-43921

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9...

CVE-2024-7304

The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Ninja Tables plugin <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Ninja Tables versions = 5.0.12...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server version 5.0 up to and including version 5.0.14...

CVE-2024-6339

The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

WordPress plugin Event Espresso 4 Decaf 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A security vulnerability...

CVE-2024-42466

Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9...

upKeeper 安全漏洞

upKeeper is a cloud-based or local solution from upKeeper, Inc. A security vulnerability exists in upKeeper version 5.1.9 and prior versions that stems from the presence of a vulnerability that improperly restricts excessive authentication attempts, allowing for misuse of authentication...

upKeeper 安全漏洞

upKeeper is a cloud-based or local solution from upKeeper, Inc. A security vulnerability exists in upKeeper version 5.1.9 and earlier, which stems from the presence of an authorization bypass via user control key vulnerability that allows the use of REST trust in system resources to gain access t...