CVE-2024-56017

Cross-Site Request Forgery CSRF vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23...

WordPress plugin Bet sport Free 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2024-54277

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through = 1.2.10...

CVE-2024-52066

This CVE-2024-52066 affects RTI Connext Professional’s Routing Service. A buffer copy without checking input size (classic buffer overflow) impacts multiple versions: 6.0.0–6.0.1.40, 6.1.0–6.1.2.21, 7.0.0–7.3.0.5, and 7.4.0–7.4.x before 7.5.0. The root cause is a missing bounds check during input...

CVE-2024-52059 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags.

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow', Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional Security Plugins allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.0.0 before 7.3.0.2, from...

CVE-2024-52057

RTI Connext Professional (Queuing Service) is affected by CVE-2024-52057 due to improper neutralization of special elements used in SQL commands, enabling SQL injection. Affected versions are: 5.2.0–5.3.* (update to after 5.3.); 6.0.0–6.0. (update to after 6.0.*); 6.1.0–6.1.2.17 (update to after ...

CVE-2024-21544

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace %20 before the file:// protocol, resulting in Local File Inclusion, which...

CVE-2024-12292

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...

CVE-2024-12333 WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

CVE-2024-50339 GLPI vulnerable to unauthenticated session hijacking

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue...

CVE-2024-48912 GLPI vulnerable to authenticated insecure account deletion

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an authenticated user can use an application endpoint to delete any user account. Version 10.0.17 contains a patch for this issue...

php: Filter bypass in filter_var (FILTER_VALIDATE_URL)

A flaw was found in PHP. An early return in the filtervar FILTERVALIDATEURL function results in invalid user information username + password part of URLs being treated as valid user information. This issue impacts users who expect only completely valid URLs to be returned by filtervar...

CVE-2024-49895 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-49895 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50287 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50287 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-47749 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-47749 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

PT-2024-10365 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A null pointer dereference vulnerability has been discovered in the gst matroska demux parse blockgroup or simpleblock function within matroska-demux.c. This function does not properly check th...

Mozilla Thunderbird < 128.5.2

The version of Thunderbird installed on the remote Windows host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory. - The Matrix specification demands homeservers to perform validation of the server-name and media-id components of MXC URIs...

CVE-2024-53954 Animate | Integer Underflow (Wrap or Wraparound) (CWE-191)

Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

GeoServer 2.25.0 < 2.25.1 Sensitive Information Exposure

According to its banner, the version of GeoServer running on the remote host is 2.10.0 prior to 2.24.4 or 2.25.x prior to 2.25.1. It is, therefore, affected by a Sensitive Information Exposure. Note that the scanner has not tested for these issues but has instead relied only on the application's...

GeoServer 2.20.0 < 2.20.4 Insecure Deserialization

According to its banner, the version of GeoServer running on the remote host is prior to 2.19.6 or 2.20.0 2.20.4. It is, therefore, affected by an Insecure Deserialization Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...