CVE-2024-8482

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PhpSpreadsheet 安全漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A security vulnerability exists in PhpSpreadsheet that stems from allowing image size and type to be retrieved by reading the contents of a file. An attacker exploiting this vulnerability can...

The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to intercept a user’s account credentials.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the redirection of the URL to an unreliable website. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain control of the user account...

CLSA-2024-1727895152 php: Fix of 3 CVEs

CVE-2020-7071: fix URL validation with functions like filtervar$url, FILTERVALIDATEURL - CVE-2021-21705: fix URL validation functionality via filtervar function with FILTERVALIDATEURL parameter when an URL with invalid password field can be accepted as valid - CVE-2024-5458: fix early-out for...

Eclipse GlassFish 输入验证错误漏洞

Eclipse GlassFish is an open source application server from the Eclipse Foundation. An input validation error vulnerability exists in Eclipse GlassFish versions prior to 7.0.17, which stems from a Host HTTP parameter that may cause a web application to redirect to a specified URL when the request...

cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server,...

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE 安全漏洞

The Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE DFS ProGauge MAGLINK LX CONSOLE is an industrial console from Dover Fueling Solutions, USA, designed for expansion. A security vulnerability exists in Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE version 3.4.2.2.6 and prior versions,...

VulnCheck KEV: CVE-2015-8813

The PageLoad function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery SSRF attacks via the url parameter...

VulnCheck KEV: CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission...

CVE-2024-45787

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the AP...

Uniong WebITR 输入验证错误漏洞

Uniong WebITR is an online time and attendance system from China Kaifa Uniong. An input validation error vulnerability exists in Uniong WebITR 21027 and prior versions, which stems from the fact that a user can be tricked into redirecting to another page via a spoofed URL, which could lead to a...

Loway QueueMetrics 输入验证错误漏洞

Loway QueueMetrics is a tool from Loway that allows you to automate the installation of a pre-configured QueueMetrics system on the most common Asterisk distributions. An input validation error vulnerability exists in Loway QueueMetrics version 22.11.6, which stems from a URL redirection to an...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

CVE-2024-5879

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

The vulnerability of Google Chrome’s Picture In Picture technology, which allows a hacker to manipulate the content of a URL string

The vulnerability of Google Chrome’s Picture In Picture technology is related to the distortion of important information in the user interface. Exploiting this vulnerability can allow a malicious actor to manipulate the content of the URL string using a specially created HTML page...

QR Code Bookmark System 跨站脚本漏洞

QR Code Bookmark System is a QR code bookmark system for rems individual developers. A cross-site scripting vulnerability exists in SourceCodester QR Code Bookmark System version 1.0, which originates from a cross-site scripting vulnerability in the tblbookmarkid/name/url parameter of the...

Learning with Texts 安全漏洞

Learning with Texts LWT is a software application by the individual developer Jon Gauthier. It allows users to import text, read, save, view and test words and expressions in multiple languages. A security vulnerability exists in Learning with Texts version 2.0.3, which stems from not filtering...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

PT-2024-6636 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: The issue is related to a cross-site scripting vulnerability in Microsoft Dynamics 365 on-premises. It may allow a remote attacker to conduct cross-site scripting...

PT-2024-19111 · Enphase · Enphase Iq Gateway

Name of the Vulnerable Software and Affected Versions: Enphase IQ Gateway formerly known as Enphase versions 4.x through 7.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a Command Injection vulnerability. This vulnerability c...