4074 matches found
Qualcomm Chipsets Security Vulnerability
Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets due to a memory corruption when processing MBSSID beacons containing multiple child elements IE...
Linux kernel thermal_zone_device_register_with_trips DoS
The vulnerability of the thermalzonedeviceregisterwithtrips function in the drivers/thermal/thermalcore.c file of the Linux kernel’s temperature control driver is related to a pointer dereferencing error. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2024-25098: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support allows Stored XSS.This issue affects PB oEmbed HTML5 Audio – with Cache Support: from n/a through 2.6...
CVE-2024-1698: Improper Neutralization of Special Elements used in an SQL Command
The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and la...
CVE-2024-26491
A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...
CVE-2024-26491: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...
PT-2024-21405
Name of the Vulnerable Software and Affected Versions flusity-CMS version 2.33 Description A cross-site scripting XSS issue in the Addon JD Flusity 'Media Gallery with description' module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery nam...
MAL-2024-1018 Malicious code in confusiontestt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis de074951e7ccfafea6554140dc00823f14dd665c36e60eb6d06933018831f53e The OpenSSF Package Analysis project identified 'confusiontestt' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
This Week in Spring - February 20th, 2024
Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you this fine 20th of February, 2024? I'm doing alright on this rainy 20th of Feburary here in San Francisco, and I hope you are too! We've got a ton of things to get into this week so let's dive right into it! Have y...
CVE-2024-1322: Missing Authorization
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setupwizard' function in all versions up to, and including, 7.8.4. This makes it possible for...
CVE-2024-0656: Improper Neutralization of Input During Web Page Generation
The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Captcha Site Key in all versions up to, and including, 2.6.6 due to insufficient input sanitization and output escaping...
CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...
CVE-2024-23789: Improper Neutralization of Special Elements used in an OS Command
Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product...
CVE-2024-23784: Undefined Security Weakness
Improper access control vulnerability exists in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier, which may allow a network-adjacent unauthenticated attacker to obtain a username and its hashed password displayed on the management page of the affected...
CVE-2024-23785: Cross-Site Request Forgery (CSRF)
Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings...
CVE-2024-23783: Missing Authentication for Critical Function
Improper authentication vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to access the affected product without authentication...
PT-2024-2569
Name of the Vulnerable Software and Affected Versions Intel Xeon D Processors with Intel SGX affected versions not specified Description The issue is related to an incorrect calculation in the microcode keying mechanism for some Intel Xeon D Processors with Intel SGX. This may allow a privileged...
CVE-2024-23787: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product...
CVE-2024-23786: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user who is accessing the management page of the affected...
