2303 matches found
CVE-2024-45263
Several GL-iNet devices, including models MT6000 , MT3000 , MT2500 , AXT1800 , and AX1800 running firmware version 4.6.2 , are susceptible to an arbitrary file upload vulnerability. The upload interface lacks sufficient validation, allowing an attacker to upload and execute arbitrary files on the...
CVE-2024-45263
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control...
CVE-2024-45263: Unrestricted Upload of File with Dangerous Type
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The upload interface allows the uploading of arbitrary files to the device. Once the device executes the files, it can lead to information leakage, enabling complete control...
PT-2024-33887
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A NULL-pointer dereference issue was found in the Linux kernel's NFSv4 implementation, specifically in the nfs42 complete copies function. This issue can occur when files are copied from one...
MAL-2024-9373 Malicious code in hpkofi (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35d1b95291e601b027075607893a6eda408516de1407619b513432c3c2e6d1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in 5pjh9i (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b146f124ef7685c191891b06d1253b04cb7df55faa519897a63f8156a8070f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-21199
Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...
CVE-2024-21207
Removed by vendor...
CVE-2024-21200
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.35 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...
CVE-2024-21203: Uncontrolled Resource Consumption
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: FTS. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...
CVE-2024-47652 Insecure Authentication Vulnerability
This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile...
CVE-2024-9119
CVE-2024-9119 affects the WordPress SVG Complete plugin (versions
WordPress SVG Complete plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin SVG Complete versions = 1.0.2...
WordPress plugin SVG Complete 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress SVG Complete Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software SVG Complete Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9119 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 95edb305fb40 Credits Francesco Carlucci Required...
CVE-2024-9119: Improper Neutralization of Input During Web Page Generation
The SVG Complete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...
CVE-2024-45383
A mishandling of IRP requests vulnerability exists in the HDAudBusDMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 WinBuild.160101.0800. A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can...
CVE-2024-45383: Improper Control of a Resource Through its Lifetime
A mishandling of IRP requests vulnerability exists in the HDAudBusDMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 WinBuild.160101.0800. A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can...
CVE-2024-7950: Improper Limitation of a Pathname to a Restricted Directory
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Local File Inclusion, Arbitrary Settings Update, and User Creation in all versions up to, and including, 2.1.6 via several functions called by the 'checkFormRequest' function...
