505 matches found
CVE-2024-24291
An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL...
CVE-2024-24291
An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL...
Cross site scripting
WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /site/default/search...
CVE-2024-22550
An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code via uploading a crafted SVG file...
GLSA-202401-27 : Ruby: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202401-27 Ruby: Multiple vulnerabilities - An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header...
CVE-2024-0252
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability...
CVE-2024-20691
Windows Themes Information Disclosure Vulnerability...
The components of the Zabbix monitoring system are vulnerable. This universal monitoring system allows attackers to access confidential data and compromise its integrity.
The vulnerability of various components of the Zabbix monitoring system’s universal architecture is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and compromise its integrity...
CVE-2023-48966
An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file...
Design/Logic Flaw
An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a crafted URL to download a malicious PHP file...
TOTOLINK X6000R Security Vulnerability
TOTOLINK X6000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X6000R version V9.4.0cu.652B20230116 and V9.4.0cu.852B20230719, which stems from the command parameter of the setting/setTracerouteCfg component that can execute arbitrary...
Cross site request forgery (csrf)
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...
CVE-2023-45952
An arbitrary file upload vulnerability in the component ajaxlink.php of lylmespage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file...
Privilege escalation
An arbitrary file upload vulnerability in the component ajaxlink.php of lylmespage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file...
CVE-2023-45904
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /variable/update...
CVE-2023-45902
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/attachment/delete...
Privilege escalation
An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
CVE-2023-44974
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...
The vulnerability in the builtin.c component allows for data reformatting according to specified templates using Gawk. This enables an attacker to gain unauthorized access to protected information or cause service failures.
The vulnerability of the builtin.c component, related to data reformatting functions using the Gawk template engine, stems from the operation of writing data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...