CVE-2024-40886 One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

PT-2024-5772 · Cyberark · Cyberark Identity Management

Name of the Vulnerable Software and Affected Versions: CyberArk affected versions not specified Description: The issue is related to the implementation of security functions on the client-side in CyberArk Identity Management, which can be exploited by a remote attacker to elevate their privileges...

Online Survey System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Survey System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits |...

Online ID Generator 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online ID Generator 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits | ...

Online Banking System 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Banking System 1.0 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits ...

kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpcremovepipedir workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel...

CVE-2024-41226

A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted payload. NOTE: Automation Anywhere disputes this report, arguing the attacker executes everything from the client side and does not attack the Control Room. T...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

CVE-2024-21467

Information disclosure while handling beacon probe frame during scan entry generation in client side...

CVE-2024-21467

CVE-2024-21467 is a WLAN information-disclosure issue arising from how beacon probe frames are processed during scan entry generation on the client side. Affected component: Qualcomm WLAN/host stack; root cause: out-of-bounds beacon probe frame handling leading to information disclosure with pote...

CVE-2024-21467 Buffer Over-read in WLAN Host Communication

Information disclosure while handling beacon probe frame during scan entry generation in client side...

CVE-2024-21467 Buffer Over-read in WLAN Host Communication

Information disclosure while handling beacon probe frame during scan entry generation in client side...

PT-2024-18888 · Qualcomm · Snapdragon +122

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves information disclosure when handling beacon probe frames during scan entry generation on the client side. Recommendations: At the...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

CVE-2024-6620

Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. An attacker could potentially inject malicious code which may lead to information disclosure, session theft, or client-side request forgery. Honeywell recommends updating to...

CVE-2024-6620

Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. An attacker could potentially inject malicious code which may lead to information disclosure, session theft, or client-side request forgery. Honeywell recommends updating to...

CVE-2024-6620

Honeywell PC42t, PC42tp, and PC42d printers (firmware T10.19.020016–T10.20.060398) are affected by a cross-site scripting vulnerability. The issue could allow an attacker to inject malicious script potentially leading to information disclosure, session theft, or client-side request forgery. Remed...

PT-2024-37751 · Honeywell · Honeywell Pc42D +1

Name of the Vulnerable Software and Affected Versions: Honeywell PC42t, PC42tp, and PC42d Printers versions T10.19.020016 through T10.20.060397 Description: The issue allows an attacker to inject malicious code, potentially leading to information disclosure, session theft, or client-side request...

GHSA-G3CH-RX76-35FX vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)

A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code...

CVE-2024-6783 Vue client-side XSS via prototype pollution

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code...