PT-2024-27418 · Unknown · Mndpsingh287 File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 File Manager versions n/a through 7.2.7 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

Exploit for Missing Authentication for Critical Function in Cyberpanel

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

WordPress Sided Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Sided Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50554 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6ea37d841f44 Credits SOPROBRO Required privilege Contributor Published ...

WordPress Selar.co Widget Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Selar.co Widget Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51598 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e6f82418395f Credits SOPROBRO Required privilege Contributor...

PT-2024-16367 · Sourcecodester · Sourcecodester Airport Booking Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Airport Booking Management System version 1.0 Description: A critical issue was found in the function details of the component Passport Number Handler, leading to buffer overflow. The attack needs to be approached locally. The...

PT-2024-33624 · Google · Google Docs Rsvp

Name of the Vulnerable Software and Affected Versions: Google Docs RSVP versions n/a through 2.0.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability and Stored XSS in Google Docs RSVP. Recommendations: For versions n/a through 2.0.1, update to a version that...

PT-2024-33073 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/doAdminAction.php endpoint, specifically when the act parameter is set to editAdmin and the id parameter is set to 17. This allows...

PT-2024-28233

Name of the Vulnerable Software and Affected Versions VMware Spring versions prior to 6.1.13 Description The issue concerns improper access controls via DataBinder and String.toLowerCase, which has locale-dependent exceptions. This could result in fields not being protected as expected, potential...

PT-2024-16027 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A path traversal vulnerability exists due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host...

CVE-2021-4451 NinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization

The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable softwa...

CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.

Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery CSRF middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. Th...

GHSA-4WX3-54GH-9FR9 Cross site scripting in markdown-to-jsx

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown...

PT-2024-31485 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 6.6.0 through 8.11.3 Apache Solr versions 9.0.0 through 9.6.x Description: The issue arises from the insecure default initialization of resources in Apache Solr, where new ConfigSets created via a Restore command lack the...

PT-2024-36385

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 Safari versions prior to 18.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: Processing...

GO-2024-3175 Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju

Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

WordPress WP Builder Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

Software WP Builder Type Plugin Vulnerable versions = 3.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9457 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 77cec314410d Credits Francesco Carlucci Required...

PT-2024-38039

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The /api/pipelines/upload endpoint is susceptible to arbitrary file write and deletion due to improper sanitization of the file.filename variable when concatenated with CACHE DIR. This allows...

PT-2024-31739

Name of the Vulnerable Software and Affected Versions: Apache Subversion versions up to and including 1.14.3 Description: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables may lead to unexpected command line argument...

CVE-2024-9314 Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'setredirections' function. This makes it possible for authenticated attackers, with...