JVN#26225832: EC-CUBE plugin (for EC-CUBE 4 series) "EC-CUBE Web API Plugin" vulnerable to stored cross-site scripting

EC-CUBE plugin for EC-CUBE 4 series "EC-CUBE Web API Plugin" provided by EC-CUBE CO.,LTD. contains a stored cross-site scripting vulnerability CWE-79 in OAuth Management feature. Impact When there are multiple users using OAuth Management feature and one of them inputs some crafted value on the...

carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2024-41810 via twisted (22.4.0)

twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2024-41810 Source advisory:...

JVN#84326763: Multiple vulnerabilities in SKYSEA Client View

SKYSEA Client View provided by Sky Co.,LTD. is an Enterprise IT Asset Management Tool. SKYSEA Client View contains multiple vulnerabilities listed below. Improper access control in the specific process CWE-266 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8 CVE-2024-41139 Origin...

CVE-2024-26520: Unverified Password Change

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets...

SQL Injection Vulnerability in WisdomWater Business Charge Management System of New Day Technology Co. Ltd (CNVD-2024-36424)

Xintian Technology Co., Ltd. is an enterprise mainly engaged in the instrumentation manufacturing industry. A SQL injection vulnerability exists in the WisdomWater WisdomWater Business Charge Management System of Xintian Technology Co. Ltd. that can be exploited by attackers to obtain sensitive...

CVE-2024-36475

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed...

CVE-2024-36475

CVE-2024-36475 affects FutureNet NXR/VXR/WXR series by Century Systems. The issue is an active debug code that, if a user who knows how to use the debug function logs in, may be used to execute arbitrary OS commands. Sources consistently describe this as a debug-code vulnerability (CWE-489) with ...

CVE-2024-36475

FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. contain an active debug code vulnerability. If a user who knows how to use the debug function logs in to the product, the debug function may be used and an arbitrary OS command may be executed...

CVE-2024-31070

Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly...

Command Execution Vulnerability in UFIDA NC Cloud at UFIDA Network Technology Co.

UFIDA NC Cloud is a large-scale enterprise digitalization platform launched by UFIDA Network Technology Co. A command execution vulnerability exists in UFIDA NC Cloud, which can be exploited by an attacker to execute arbitrary commands...

CVE-2024-40535

Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apnname3g parameter in the config3gpara function...

CVE-2024-40515

An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48cn allows a remote attacker to execute arbitrary code via the Routing functionality...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

CVE-2024-40425

A File Upload vulnerability exists in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall) versions v.1.1.6 and before . A remote attacker can exploit the controller/common.php component to achieve arbitrary code execution . The impact is rated as CRITICAL (CVSS 3.1 score of 9.8). To m...

KingH5Stream of Beijing Asian Control Technology Development Co. Ltd. suffers from a logic flaw vulnerability (CNVD-2024-35270)

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise founded in 1997 as a software platform for industrial automation and informatization. A logic flaw vulnerability exists in KingH5Stream of Beijing Asian Control Technology Development Co. Ltd, which can be exploited ...

CVE-2024-40516

An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality...

CVE-2024-40535: Stack-based Buffer Overflow

Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apnname3g parameter in the config3gpara function...

CVE-2024-40425

File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component...

SUSE CVE-2023-6917

A vulnerability has been identified in the Performance Co-Pilot PCP package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges...