TP-Link Archer C50 安全漏洞

The TP-LINK Archer C50 is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-Link Archer C50 prior to version V4 240917, which stems from terminal access on the serial interface that is not properly privileged, allowing an attacker to obtain Wi-Fi credentials on t...

PT-2024-27669 · Unknown · Com.Grice.Call

Name of the Vulnerable Software and Affected Versions: com.grice.call application version 4.5.2 Description: The issue allows any installed application, even those without permissions, to place phone calls without user interaction by sending a crafted intent via the...

CVE-2024-53502

Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMSSeoAndTag.php page...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improper sanitization of XML body in the fromString function. Workaround Remove the LIBXMLDTDLOAD | LIBXMLDTDATTR options from $options Details XXE Injection is a type of attack against an...

CVE-2024-53619

An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-11024

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.6. This is due to the plugin not properly validating a user's password reset code prior to updating their password. This makes it possibl...

WordPress AppPresser plugin <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset vulnerability

Unauthenticated Privilege Escalation via Password Reset vulnerability discovered by shaman0x01 in WordPress Plugin AppPresser versions = 4.4.6...

eNMS 路径遍历漏洞

eNMS is an open source network automation platform from eNMS. A path traversal vulnerability exists in eNMS version 4.2 and earlier. An attacker could exploit this vulnerability to access sensitive files or directories on the system...

PT-2024-17174 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions up to 4.2 Description: A critical issue has been found in the function multiselect filtering of the file eNMS/controller.py of the component TGZ File Handler. The manipulation leads to path traversal. The attack may be launched...

DataGear 注入漏洞

DataGear is an open source and free data visualization and analysis platform from DataGear, Inc. An injection vulnerability exists in DataGear version 4.60 and earlier versions, which stems from an incorrect manipulation of the parameter sql that can lead to sql injection...

SUSE CVE-2024-11596

ECMP dissector crash in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon versions 4.1.x prior to 4.1.17 and 4.2.x prior to 4.2.9, which stems from a vulnerability that allows rate limiting to be bypassed via a crafted HTTP reque...

WordPress plugin 3D FlipBook, PDF Viewer, PDF Embedder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin 3D FlipBoo...

kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

A flaw was found in the Linux kernel. A system error can be reliably replicated with specific filesystem settings, allowing an attacker to cause a denial of service...

WordPress MPG plugin <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion vulnerability

Authenticated Editor+ Directory Traversal to Limited File Deletion vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin MPG versions = 4.0.2...

WordPress plugin Multiple Page Generator Plugin – MPG 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Multiple...

PT-2024-20850 · Sublime Text · Sublime Text

Name of the Vulnerable Software and Affected Versions: Sublime Text version 4 Description: A command injection issue was found in Sublime Text via the New Build System module. It is noted that multiple third parties report this behavior as intended. Recommendations: For Sublime Text version 4, as...

Sublime Text 安全漏洞

Sublime Text is a cross-platform, extensible text editor from Sublime, Inc. A security vulnerability exists in Sublime Text version 4, which stems from a discovery via the New Build System module that contains a command injection vulnerability...

PT-2024-16182 · Unknown · Gliffy Online

Name of the Vulnerable Software and Affected Versions: Gliffy Online versions prior to 4.14.0-6 Description: An insecure configuration was discovered in Gliffy Online. The issue was reported by Alpha Inferno PVT LTD. Recommendations: For versions prior to 4.14.0-6, update to version 4.14.0-6 or...

PT-2024-32077 · Weechat +1 · Weechat +1

Name of the Vulnerable Software and Affected Versions: WeeChat versions prior to 4.4.2 Description: The issue is caused by an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects functions such as string free split...