WordPress TNC PDF viewer plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin TNC PDF viewer versions = 3.1.0...

WordPress TNC PDF viewer Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software TNC PDF viewer Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47372 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9e1d9364ffe7 Credits SOPROBRO Required privilege Editor...

Malicious code in neuron-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39e11d5c0e9f49ca7c1e136d6f73f692162e1873d0def4a3135bd3dacbdd9ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8997 Malicious code in neuron-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39e11d5c0e9f49ca7c1e136d6f73f692162e1873d0def4a3135bd3dacbdd9ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47182

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3...

CVE-2024-47182

CVE-2024-47182 affects Dozzle prior to 8.5.3 where passwords are hashed with sha-256, enabling rainbow table attacks. Version 8.5.3 switches to bcrypt, addressing the vulnerability. Publicly referenced advisories (SUSE/openSUSE ecosystem) include this CVE in their security updates. Remediation: u...

CVE-2024-47182 Dozzle uses unsafe hash for passwords

Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3...

PT-2024-32277 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.1 Description: A SQL Injection issue allows an authenticated low-privileged user, with at least Report Viewer permissions, to escalate privileges to the admin account. This issue can be exploited by a use...

Foxit PDF Reader < 2024.3 Multiple Vulnerabilities

According to its version, the Foxit PDF Reader application previously named Foxit Reader installed on the remote Windows host is prior to 2024.3. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the way Foxit Reade 2024.1.0.23997 handles a checkbox...

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software lies in the possibility of an operation going beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of PDF-XChange Editor, a program for viewing and editing PDF documents, relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created XPS file...

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software, related to the occurrence of operations outside the buffer in memory, allows attackers to disclose protected information.

The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information using a specially created U3D file...

(0Day) FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

PT-2024-39441 · Faststone · Faststone Image Viewer

Name of the Vulnerable Software and Affected Versions: FastStone Image Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this issue, where th...

PT-2024-39440 · Faststone · Faststone Image Viewer

Name of the Vulnerable Software and Affected Versions: FastStone Image Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this issue, where th...

(0Day) FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

(0Day) FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

PT-2024-39439 · Faststone · Faststone Image Viewer

Name of the Vulnerable Software and Affected Versions: FastStone Image Viewer affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of FastStone Image Viewer. User interaction is required to exploit this issue, where th...

CVE-2024-6979

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of...

PT-2024-37745 · Endress+Hauser · Fieldcare +1

Name of the Vulnerable Software and Affected Versions: Endress+Hauser products, including Echo Curve Viewer and FieldCare software affected versions not specified Description: An unauthenticated remote attacker can run malicious C code included in curve files and execute commands in the user's...

Endress+Hauser Echo Curve Viewer 代码注入漏洞

Endress+Hauser Echo Curve Viewer is an echo curve viewer from Endress+Hauser, Switzerland. A code injection vulnerability exists in Endress+Hauser Echo Curve Viewer version 5.2.2.6 and prior versions, which originates from the fact that an unauthenticated, remote attacker can run malicious c code...