CVE-2024-47611 XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows MinGW-w64 or MSVC, the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters for exampl...

CVE-2024-8800

The RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and...

SUSE CVE-2024-47516

A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance...

The vulnerability of the version_upgrade.asp function in D-Link router microprogramming devices such as DI-7003G, DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 allows a hacker to execute arbitrary commands.

The vulnerability of the versionupgrade.asp function in D-Link router microprogramming devices such as DI-7003G, DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 is related to insufficient testing of the arguments passed in the command. Exploitation of this...

The vulnerability of the CGI function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 allows attackers to execute arbitrary commands.

The vulnerability of the CGI function in D-Link router microprogramming devices such as DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 lies in insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute...

GHSA-QWRQ-VXVW-537R git-shallow-clone Argument Injection vulnerability

All versions of the package git-shallow-clone are vulnerable to Argument injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function...

PT-2024-39350 · WordPress · Broken Link Checker

Name of the Vulnerable Software and Affected Versions: Broken Link Checker plugin for WordPress versions up to, and including, 2.4.0 Description: The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg in...

WordPress plugin EU/UK VAT Manager for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2024-39548 · Unknown · Skyselang Yyladmin

Name of the Vulnerable Software and Affected Versions: skyselang yylAdmin versions up to 3.0 Description: A critical issue was found in the Backend component, specifically in the function list of the file /app/admin/controller/file/File.php. The manipulation of the is disable argument leads to SQ...

PT-2024-39538 · Unknown · Kalvingit Kvf-Admin

Name of the Vulnerable Software and Affected Versions: kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff Description: A critical issue has been found in the fileUpload function of the FileUploadKit.java file, allowing for unrestricted upload by manipulating the file argument. Thi...

PT-2024-8960 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 Description: A critical issue affects the formResetStatistic function in the file /goform/formResetStatistic. The manipulation of the curTime argument leads to a buffer overflow. This can be initiated remotely...

CVE-2024-8067

In versions of Helix Core prior to 2024.1 Patch 2 2024.1/2655224 a Windows ANSI API Unicode "best fit" argument injection was identified...

PT-2024-39193 · WordPress · Kodex Posts Likes Plugin

Name of the Vulnerable Software and Affected Versions: Kodex Posts likes plugin for WordPress versions up to, and including, 2.5.0 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts int...

CVE-2024-8067

CVE-2024-8067 affects Perforce Helix Core prior to 2024.1 Patch 2 (2024.1/2655224). The issue is a Windows ANSI API Unicode “best fit” argument injection in Helix Core, caused by the best fit parameter handling. Public sources consistently describe this as a parameter injection vulnerability that...

CVE-2024-8067 Unicode "best fit" argument injection

In versions of Helix Core prior to 2024.1 Patch 2 2024.1/2655224 a Windows ANSI API Unicode "best fit" argument injection was identified...

kernel: drm/amdgpu: add error handle to avoid out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdmav40irqidtoseq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL...

kernel: drm/amdgpu: add error handle to avoid out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdmav40irqidtoseq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL...

CVE-2024-9089

CVE-2024-9089 affects SourceCodester Modern Loan Management System 1.0. The vulnerability is a cross-site scripting issue caused by manipulation of the amount parameter in update_loan_record.php. The attack can be initiated remotely, and the exploit has been disclosed publicly. Practical impact i...

CVE-2024-9082 SourceCodester Online Eyewear Shop User Creation Users.php improper authorization

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

CVE-2024-9078

A vulnerability has been found in code-projects Student Record System 1.0 and classified as critical. This vulnerability affects unknown code of the file /course.php. The manipulation of the argument coursename leads to sql injection. The attack can be initiated remotely. The exploit has been...