CVE-2024-10099: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewe...

Malware in avail-able-albu-m-down-load-15496-morning-view-pbn51-tjmcxv

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-20462

A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device. This vulnerability is due to incorrect sanitization of HTML conte...

CVE-2024-20458

A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device. This vulnerability is due to a lack of authentication o...

CVE-2024-9348

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view...

CVE-2024-9348 Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view...

CVE-2024-9348 Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view...

CVE-2024-9348

Docker Desktop is affected by CVE-2024-9348 on versions prior to 4.34.3. The issue is a remote code execution (RCE) vulnerability caused by unsanitized GitHub source links in the Build view, allowing an attacker to execute arbitrary code. Public sources across Nessus plug‑ins, CVELIST, CNNVD, and...

WordPress Kento Post View Counter plugin <= 2.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by WordFence in WordPress Plugin Kento Post View Counter versions = 2.8...

CVE-2016-15040

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVE-2016-15040

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection in versions up to and including 2.8 . The flaw exists because the 'kento_pvc_geo' parameter lacks sufficient escaping and preparation in the underlying SQL query. This allows unauthenticated attackers to append malici...

CVE-2016-15040 Kento Post View Counter <= 2.8 - SQL Injection

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

WordPress Kento Post View Counter Plugin <= 2.8 is vulnerable to SQL Injection

Software Kento Post View Counter Type Plugin Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2016-15040 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID ec30554661e3 Credits WordFence Required privilege Unauthenticate...

PT-2024-10573

Name of the Vulnerable Software and Affected Versions Kento Post View Counter plugin for WordPress versions up to, and including, 2.8 Description The issue allows unauthenticated attackers to perform SQL Injection via the kento pvc geo parameter due to insufficient escaping on the user-supplied...

Docker Desktop security vulnerabilities

Docker Desktop is a desktop software for lightweight deployment of applications based on container technology from Docker Inc. in the United States. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

CVE-2016-15040: Improper Neutralization of Special Elements used in an SQL Command

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

CVE-2024-9348: Improper Input Validation

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view...

Cisco ATA 190 security vulnerability

The Cisco ATA 190 is an analog telephone adapter from Cisco USA. A security vulnerability exists in the Cisco ATA 190 that stems from improper cleaning of HTML content on the affected device. An authenticated local attacker with low privileges could exploit the vulnerability to view passwords on...

PT-2024-10843 · WordPress · Indeed Membership Pro

Name of the Vulnerable Software and Affected Versions: Indeed Membership Pro plugin for WordPress versions 7.3 through 8.6 Description: The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions. This makes it...

CVE-2024-38190: Missing Authorization

Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector...