CVE-2024-10754 PHPGurukul Online Shopping Portal dymanic_table.php cross site scripting

A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /admin/assets/plugins/DataTables/media/unittesting/templates/dymanictable.php. The manipulation of the argument scripts leads to cross site...

ALSA-2024:8800 Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

PHPGurukul Online Shopping Portal 跨站脚本漏洞

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a cross-site scripting vulnerability that stems from a lack of valid filtering and escaping of user-supplied data in the scripts parameter of file...

CVE-2024-48039

Missing Authorization vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.15...

WordPress Dynamic Widgets plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Dynamic Widgets versions = 1.6.4...

WordPress SmartLink Dynamic URLs plugin <= 1.1.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin SmartLink Dynamic URLs versions = 1.1.0...

SUSE CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

WordPress SmartLink Dynamic URLs Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software SmartLink Dynamic URLs Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51657 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 2370d451d4d5 Credits SOPROBRO...

WordPress Dynamic Widgets Plugin <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Dynamic Widgets Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-51669 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 96b0608ca8f4 Credits Ananda Dhakal Patchstack...

The vulnerability of the DatabaseSearch function in the XWiki platform, a tool for creating collaborative web applications. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of the DatabaseSearch function in the XWiki platform for creating collaborative web applications stems from the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remote...

The vulnerability of the RtsPer.sys and RtsUer.sys drivers of Realtek SD card readers, related to memory release errors, allows an attacker to gain access to the kernel’s stack memory and dynamic memory.

The vulnerability of the RtsPer.sys and RtsUer.sys drivers of Realtek SD card readers is related to memory release errors. Exploiting this vulnerability can allow an attacker to gain access to kernel memory from the stack and dynamic memory...

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

Lilconfig 安全漏洞

Lilconfig is a nodejs configuration finder by the individual developer Anton Kastritskii. A security vulnerability exists in Lilconfig version 3.1.0 up to and including version 3.1.1, which stems from the unsafe use of eval in the dynamicImport function. An attacker can exploit the vulnerability ...

The vulnerability of the Dynamic Access Policies function in microprogramming-based network interface controllers of Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to induce service failures.

The vulnerability of the Dynamic Access Policies function in microprogramming-based network interface controllers of Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to improper validation of the specified type of input data. Exploiting this vulnerability c...

Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials

Overview Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP.The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware...

JVN#11779839: Hikvision network camera security enhancement to prevent cleartext transmission of Dynamic DNS credentials

Multiple network cameras provided by Hangzhou Hikvision Digital Technology Co., Ltd. support two Dynamic DNS services, DynDNS and NO-IP. The user can select which to use on the GUI configuration page. Both the services provide their APIs accessible via HTTP and HTTPS, but old firmware versions of...

PT-2024-41474 · Hikvision · Ds-2Cd1Xxxg0 +11

Уязвимость реализации протокола HTTP служб DynDNS и NO-IP микропрограммного обеспечения IP-камер Hikvision связана с передачей конфиденциальной информации в незашифрованном виде. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить атаку типа «человек посередине»...

PT-2024-22238 · Wbr-6012 · Wbr-6012

Name of the Vulnerable Software and Affected Versions: WBR-6012 affected versions not specified Description: The WBR-6012 is a wireless SOHO router that functions as an internet gateway for homes and small offices. It provides a WiFi access point and serves as a 4-port wired router, implementing...

CVE-2024-8594

A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

Express ressource injection

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and to...