PT-2024-29567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions prior to 5.2.3 Description: Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker is able to re-submit a valid TOTP token to establish an authenticated session. This requires that th...

CVE-2024-39962

D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21D240126 was discovered to contain a remote code execution RCE vulnerability in the ntpzoneval parameter at /goform/setntp. This vulnerability is exploited via a crafted HTTP request...

Juniper Networks Junos OS Evolved Security Vulnerability

Juniper Networks Junos OS Evolved is an upgraded version of Juniper Networks' Junos OS system. A security vulnerability exists in Juniper Networks Junos OS Evolved, which arises from a vulnerability in packet processing that does not properly check for anomalies or unusual conditions, allowing an...

Decidim cross-site scripting (XSS) in the admin panel

Impact The admin panel is subject to potential XSS attach in case the attacker manages to modify some records being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. And then enter the returned blob ID to the form inputs manually b...

Ubuntu: Security Advisory (USN-6879-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SQL Injection

craftcms/cms is vulnerable to SQL Injection. The vulnerability is caused by insufficient sanitization and validation of user-supplied input within GraphQL queries, allowing attackers to manipulate these queries to execute arbitrary SQL commands...

GHSA-HQ4F-MV3Q-8WCV Craft CMS SQL injection vulnerability via the GraphQL API endpoint

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

Craft CMS SQL injection vulnerability via the GraphQL API endpoint

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

CVE-2024-37843

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

CVE-2024-23159

A maliciously crafted STP file, when parsed in stpaimx64vc15d.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current process...

CVE-2024-37002

A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process...

CVE-2024-37843

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

PT-2024-27777 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions up to v3.7.31 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "GraphQL API endpoint". There is no information provided about the estimated number of potentiall...

CVE-2024-37843

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

CVE-2024-37843

Craft CMS

CVE-2024-37843

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint...

CVE-2024-28397

CVE-2024-28397 affects the Python js2py library (versions up to 0.74). The vulnerability enables a sandbox escape and remote code execution by abusing Python object introspection from JavaScript. Attackers can obtain a PyObjectWrapper via Object.getOwnPropertyNames({}) and then traverse to Python...

Exploit for SQL Injection in Craftcms Craft_Cms

CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-base...

Unspecified Vulnerability in Adobe Experience Manager (CNVD-2024-28509)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

SUSE CVE-2020-27823

A flaw was found in OpenJPEG's encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...