1777 matches found
CBL Mariner 2.0 Security Update: kata-containers-cc / hvloader / kata-containers / nodejs18 (CVE-2023-4807)
The version of kata-containers-cc / hvloader / kata-containers / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-4807 advisory. - Issue summary: The POLY1305 MAC message authentication co...
Apache JSPWiki Cross-Site Scripting Vulnerability (CNVD-2024-41670)
Apache JSPWiki is the United States Apache Apache Foundation of a Java, Servlet and JSP-based open source WikiWiki engine to build . A cross-site scripting vulnerability exists in Apache JSPWiki 2.12.1 and earlier versions, which stems from the application's lack of effective filtering and escapi...
Devika Security Breach
Stition Devika is an advanced AI software engineer at Stition USA that understands advanced human commands, breaks them down into steps, researches the relevant information, and writes code to achieve a given goal. Devika has a security vulnerability that stems from the application having a...
CVE-2022-42974
In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting XSS attack on /file.bootloader.upload.html. The application fails to sanitize the parameter filename, in a POST request to /file.bootloader.upload.html for a system...
LG SuperSign CMS Cross-Site Scripting Vulnerability
LG SuperSign CMS is a content management software solution optimized for LG webOS kanbanban from Luckin LG Korea. A cross-site scripting vulnerability exists in LG SuperSign CMS versions prior to 4.1.3 through 4.3.1, which stems from the presence of improper input neutralization during web page...
CVE-2024-5786
Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application to which he is authenticated...
CVE-2024-5426
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘svg’ parameter in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
GHSA-WJMJ-H3XC-HXP8 Generation of Error Message Containing Sensitive Information in zsa
Impact All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit th...
CVE-2024-4148 Redos (Regular Expression Denial of Service) in lunary-ai/lunary
A Regular Expression Denial of Service ReDoS vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially...
CVE-2024-4148 Redos (Regular Expression Denial of Service) in lunary-ai/lunary
A Regular Expression Denial of Service ReDoS vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerability by maliciously manipulating regular expressions, which can significantly impact the response time of the application and potentially...
D-Link DIR-2150 Code Execution Vulnerability
The D-Link DIR-2150 is a wireless router from China-based AUO D-Link. The D-Link DIR-2150 suffers from a code execution vulnerability that stems from an application failing to properly filter special elements that construct code segments. An unauthenticated attacker could exploit the vulnerabilit...
D-Link G416 Code Execution Vulnerability
The D-Link G416 is a wireless router from China-based AUO D-Link. The D-Link G416 suffers from a code execution vulnerability that stems from the application failing to properly filter special elements that construct code segments. An attacker could exploit the vulnerability to cause arbitrary co...
WBSAirback Resource Management Error Vulnerability
WBSAirback is a next generation storage and backup system from WBSAirback. A resource management error vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to cause an application denial of service...
CVE-2024-31843
An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System...
CVE-2024-35555
CVE-2024-35555 concerns idccms v1.35 with a Cross-Site Request Forgery (CSRF) in the endpoint "/admin/share_switch.php" (parameters include mudi, dataType, fieldName, fieldName2, tabName, dataID). The vulnerability could enable unauthorized actions on behalf of an authenticated user. Exploitation...
CVE-2024-31845
An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...
CVE-2024-34772
Siemens Solid Edge is affected by CVE-2024-34772 in all versions before V224.0 Update 4, due to an out-of-bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow code execution in the context of the current process. Siemens’ mitigations advis...
qt6-base (core module) -- Invalid pointer in QStringConverter
Andy Shaw reports: QStringConverter has an invalid pointer being passed as a callback which can allow modification of the stack. Qt itself is not vulnerable to remote attack however an application using QStringDecoder either directly or indirectly can be vulnerable. This requires: the attacker be...
Cross-site Scripting (XSS)
knowledge-repo is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper user input validation in the post comments functionality. This allows an attacker to inject arbitrary web scripts or HTML content into the application, potentially leading to cross-site scripting XSS...