Lucene search
+L

3302 matches found

OSV
OSV
added 2024/01/29 8:00 p.m.10 views

CVE-2024-1018 PbootCMS cross site scripting

A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/indextab=t2. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

2.4CVSS3.9AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2024/01/29 12:00 a.m.15 views

PT-2024-16094 · Pbootcms · Pbootcms

Name of the Vulnerable Software and Affected Versions: PbootCMS version 3.2.5-20230421 Description: A problematic issue has been found, affecting an unknown function of the file /admin.php?p=/Area/indextab=t2. The manipulation of the name argument leads to cross-site scripting. It is possible to...

6.1CVSS4.1AI score0.00505EPSS
SaveExploits1References4
BDU FSTEC
BDU FSTEC
added 2024/01/29 12:00 a.m.14 views

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from an incorrect limitation on the path name for the restricted access directory. This allows a malicious user to write files to arbitrary locations on the server when creating a working area.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to perform file writing operations at arbitrary locations o...

9.9CVSS8.2AI score0.03783EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2024/01/25 9:15 p.m.81 views

CVE-2024-24399

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area...

7.2CVSS7.3AI score0.15597EPSS
SaveExploits1References4
RedHat Linux
RedHat Linux
added 2024/01/25 11:04 a.m.9 views

kernel: nfp: use-after-free in area_cache_get()

A vulnerability was found in areacacheget in drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c in the Netronome Flow Processor NFP driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue...

7.8CVSS6.5AI score0.0042EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2024/01/25 9:45 a.m.10 views

kernel: nfp: use-after-free in area_cache_get()

A vulnerability was found in areacacheget in drivers/net/ethernet/netronome/nfp/nfpcore/nfpcppcore.c in the Netronome Flow Processor NFP driver in the Linux kernel. This flaw allows a manipulation that may lead to a use-after-free issue...

7.8CVSS6.5AI score0.0042EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2024/01/25 12:00 a.m.48 views

CVE-2024-24399

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area...

7.5AI score0.15597EPSS
SaveExploits1References4
Prion
Prion
added 2024/01/24 8:15 a.m.26 views

Cross site scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

5.8CVSS6.6AI score0.00471EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2024/01/24 7:30 a.m.59 views

CVE-2024-0665

Summary: CVE-2024-0665 affects the WP Customer Area WordPress plugin. The vulnerability is a Reflected Cross-Site Scripting (XSS) via the tab parameter in versions up to and including 8.2.1, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to in...

6.1CVSS6.4AI score0.00471EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment
added 2024/01/24 7:30 a.m.5 views

CVE-2024-0665 WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS6.1AI score0.00471EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2024/01/24 2:50 a.m.5 views

SUSE CVE-2024-22705

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

7.8CVSS7.2AI score0.00252EPSS
SaveExploits0References3
BDU FSTEC
BDU FSTEC
added 2024/01/24 12:00 a.m.19 views

The vulnerability of the devinfo interface in D-Link’s microprogrammed router software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the devinfo interface in D-Link’s microprogrammed router software is related to insufficient protection of operational data during the processing of the area parameter. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information by...

5.3CVSS6.2AI score0.18195EPSS
SaveExploits1References3
CNNVD
CNNVD
added 2024/01/24 12:00 a.m.12 views

WordPress Plugin WP Customer Area Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

6.1CVSS6.2AI score0.00471EPSS
SaveExploits0References4
Patchstack
Patchstack
added 2024/01/24 12:00 a.m.19 views

WordPress WP Customer Area Plugin <= 8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Customer Area Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0665 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f88bc5bdc8b9 Credits Krzysztof Zając...

6.1CVSS5.9AI score0.00471EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2024/01/23 11:15 a.m.4 views

DEBIAN-CVE-2024-22705

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

7.8CVSS6.7AI score0.00252EPSS
SaveExploits0References1
OSV
OSV
added 2024/01/23 11:15 a.m.10 views

AZL-33961 CVE-2024-22705 affecting package kernel for versions less than 5.15.148.1-1

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2getdataarealen in fs/smb/server/smb2misc.c can cause an smbstrndupfromutf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled...

7.8CVSS6.6AI score0.00252EPSS
SaveExploits0References1
BDU FSTEC
BDU FSTEC
added 2024/01/18 12:00 a.m.16 views

The vulnerability of the Packet Forwarding Engine (PFE) in Juniper Networks’ Junos operating system, which allows a hacker to gain access to confidential data

The vulnerability of the packet forwarding engine PFE in Juniper Networks’ Junos operating system is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

7.8CVSS7.2AI score0.00375EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2024/01/16 4:15 p.m.15 views

CVE-2023-6741

The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...

4.3CVSS5.8AI score0.00394EPSS
SaveExploits1References1
NVD
NVD
added 2024/01/16 4:15 p.m.35 views

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

6.5CVSS6.4AI score0.00483EPSS
SaveExploits1References1
OSV
OSV
added 2024/01/16 4:15 p.m.15 views

CVE-2023-6824

The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address...

6.5CVSS5.8AI score0.00483EPSS
SaveExploits1References1
Rows per page
Query Builder