SiberianCMS SQL Injection Vulnerability

SiberianCMS is an enterprise-level content management system that offers a variety of features for creating and managing web content. SiberianCMS suffers from a SQL injection vulnerability that originates from the system failing to properly neutralize special elements in SQL commands. The...

Apple macOS ramrod arbitrary argv[0] execution vulnerability

Talos Vulnerability Report TALOS-2024-2010 Apple macOS ramrod arbitrary argv0 execution vulnerability July 30, 2024 CVE Number CVE-2024-40800 SUMMARY An arbitrary argv0 execution vulnerability exists in the ramrod binary of Apple macOS version 14.5 23F79 x8664. An attacker can inject an arbitrary...

CVE-2024-6881

CVE-2024-6881 concerns a stored XSS in M-Files Hubshare prior to version 5.0.6.0 . The issue allows an authenticated attacker to execute arbitrary JavaScript in a user’s browser session. Affected component is the Hubshare web interface; root cause is a stored XSS condition in the application flow...

SKYSEA Client View security vulnerabilities

SKYSEA Client View is a software from SKYSEA Japan that supports information leakage countermeasures and IT operations management. A security vulnerability exists in SKYSEA Client View versions 15.200.13i through 19.210.04e, which stems from a path traversal vulnerability that could allow an...

CVE-2024-7047 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user...

CVE-2024-26020

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability...

CVE-2024-26020

CVE-2024-26020 : The vulnerability affects Ankitects Anki 24.04, where the MPV functionality in flashcards processes user-supplied content and can trigger arbitrary code execution via a crafted flashcard. Multiple connected sources corroborate exploitation potential and assign high/critical impac...

OS Command Injection

Nuclei is vulnerable to OS Command Injection. The vulnerability is due to the -code option in code templates, allowing users to edit and execute workflow files in some web applications, leading to arbitrary command execution...

CVE-2024-6542 Livestatus injection in mknotifyd

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

CVE-2024-6542

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

TOTOLINK A6000R security vulnerabilities

TOTOLINK A6000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A6000R suffers from a command injection vulnerability that stems from the ifname parameter in the apclidoenrpinwps function failing to properly filter construct command special characters, commands, and so o...

SolarWinds Access Rights Manager UserScriptHumster Arbitrary Command Execution

The vulnerability of the UserScriptHumster class in the SolarWinds Access Rights Manager ARM access control software is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

CVE-2024-40644

gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account on Windows systems. Windows permits limited user accounts without administrative privileges to create new...

SQL Injection Vulnerability in e-cology 9 of Shanghai Panmicro Network Technology Co.

e-cology 9 is a large-scale collaborative management platform for enterprises. A SQL injection vulnerability exists in e-cology 9 of Shanghai Panmicro Network Technology Co. Under default configuration, an unauthorized attacker can exploit this vulnerability to execute arbitrary SQL statements,...

CVE-2024-40733

NetBox v4.0.3 is affected by a cross-site scripting (XSS) vulnerability that allows execution of arbitrary web scripts/HTML via a crafted payload injected into the Name field at /dcim/front-ports/{id}/edit/. The Red Hat entry and CNVD/CNNVD entries corroborate this issue. The Connected documents ...

CVE-2024-40729

NetBox v4.0.3 is vulnerable to a cross-site scripting (XSS) flaw caused by a lack of effective filtering and escaping of user-supplied data. Attackers can exploit this by injecting a crafted payload into the Name parameter at the /dcim/interfaces/add/ location to execute arbitrary web scripts or ...

CVE-2024-40728

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/console-server-ports/id/edit/...

CVE-2024-40736

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/add...

CVE-2024-40726

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-ports/id/edit/...

CVE-2024-40735

A cross-site scripting XSS vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at /dcim/power-outlets/id/edit/...