CVE-2024-46600

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/doAdminAction.php?act=delCate&id=31...

PT-2024-32068 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/admin/doAdminAction.php" API endpoint, specifically when the act parameter is set to delCate and the...

CVE-2024-46485

dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery CSRF via /admin/doAdminAction.php?act=addCate...

CVE-2024-46485

Affected software: dingfanzu CMS 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered via the admin endpoint /admin/doAdminAction.php?act=addCate. Root cause: CSRF vulnerability in the action endpoint allowing unauthorized actions if a user is authenticated. Impact:...

PT-2024-6801 · Passwork · Passwork

Name of the Vulnerable Software and Affected Versions: Passwork affected versions not specified Description: The issue is related to the incorrect implementation of a sequence of actions in the password manager. Exploitation of this issue could allow a remote attacker to impact the integrity of...

MAL-2024-8958 Malicious code in livingdesign-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa9ad15e8dcaf3a6c94d2739771d75df50a809e5356b448918bf83199d2688e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6rules: avoid possible NULL dereference in fib6ruleaction syzbot is able to trigger the following crash 1, caused by unsafe ip6dstidev use. Indeed ip6dstidev can return NULL, and must always be checked. 1 Oops: general...

CVE-2024-8662

The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2024-8716

The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-8738 Seriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scripting

The Seriously Simple Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVE-2024-8738

CVE-2024-8738 affects the Seriously Simple Stats WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting flaw caused by insufficient escaping in add_query_arg across versions up to and including 1.6.0, enabling unauthenticated attackers to inject scripts if a user is tricked into ...

PT-2024-38381 · WordPress · Husky – Products Filter Professional

Name of the Vulnerable Software and Affected Versions: HUSKY – Products Filter Professional for WooCommerce plugin for WordPress versions up to, and including, 1.3.6.1 Description: The issue is related to Insecure Direct Object Reference. It affects the plugin via the woof messenger remove subscr...

Exploit for SQL Injection in Techspawn Wp-Email-Users

CVE-2021-24959 Description --- The WP Email Users WordPress...

libfluid fluid_msg::ActionList::unpack10 routine denial of service vulnerability

libfluid is an Open Networking Foundation open source application. A programmatic denial of service vulnerability exists in the libfluid fluidmsg::ActionList::unpack10 example, which can be exploited by an attacker to cause a denial of service...

SUSE CVE-2024-46754

In the Linux kernel, the following vulnerability has been resolved: bpf: Remove tstrun from lwtseg6localprogops. The syzbot reported that the lwtseg6 related BPF ops can be invoked via bpftestrun without without entering inputactionendbpf first. Martin KaFai Lau said that self test for...

MAL-2024-8905 Malicious code in temp240824 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8a7dd6aaf4dcfd18798c971ed85382e9df124ddf047164ea6b7580ac95d9301 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-31165

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routine fluidmsg::of13::SetFieldAction::unpack. This issue affects libfluid: 0.1.0...

CVE-2024-31164

Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation ONF libfluid libfluidmsg module. This vulnerability is associated with program routines fluidmsg::ActionList::unpack13. This issue affects libfluid: 0.1.0...

libfluid 安全漏洞

libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::ActionList::unpack13 routine contains a null pointer dereference vulnerability caused by an unchecked return value...

libfluid 安全漏洞

libfluid is an Open Networking open source application. A security vulnerability exists in libfluid that stems from the fact that the fluidmsg::of13::SetFieldAction::unpack routine contains a null pointer dereference vulnerability caused by an unchecked return value...