CVE-2024-25865

CVE-2024-25865 describes a Cross-Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allowing remote attackers to execute arbitrary code via the algolia search function. The issue is documented across multiple sources (NVD, Red Hat, GHSA, OSV, CNNVD, etc.) with consistent descriptio...

Sql injection

SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component...

Mozilla Firefox for iOS cross-site scripting vulnerability (CNVD-2024-12553)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Firefox for iOS, which can be exploited by an attacker to execute script in a victim's web browser using a specially crafted URL in the security...

GHSA-V4CP-2Q7V-HG9Q livehelperchat Server-Side Template Injection

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

CVE-2023-37531

A cross-site scripting XSS vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code into a form field of a webpage by a user with privileged access...

USN-6627-1: libde265 vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libde265 could be made to read out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a...

Ubuntu: Security Advisory (USN-6651-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6653-2: Linux kernel (AWS) vulnerabilities

It was discovered that a race condition existed in the ATM Asynchronous Transfer Mode subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-51780 It was...

Memory corruption

A memory corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code...

CVE-2023-50735

Summary (CVE-2023-50735): A heap corruption vulnerability in the PostScript interpreter affects Lexmark devices. The issue can lead to arbitrary code execution and is described as exploitable remotely over a network with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.0)....

CVE-2024-27516

Server-Side Template Injection SSTI vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php...

CVE-2024-26296

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...

CVE-2024-26297

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...

CVE-2021-46928

In the Linux kernel, the following vulnerability has been resolved: parisc: Clear stale IIR value on instruction access rights trap When a trap 7 Instruction access rights occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this...

UBUNTU-CVE-2021-46928

In the Linux kernel, the following vulnerability has been resolved: parisc: Clear stale IIR value on instruction access rights trap When a trap 7 Instruction access rights occurs, this means the CPU couldn't execute an instruction due to missing execute permissions on the memory region. In this...

CVE-2021-46928

CVE-2021-46928 affects the Linux kernel on parisc: a trap7 (Instruction access rights) could leave the cr19 IIR register with a stale value. The patch fixes this by overwriting the stale IIR with the constant 0xbaadf00d when the trap occurs, preventing confusing dump values. The issue arises beca...

Sql injection

SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script...

Zoo Management System 1.0 - Unauthenticated Remote Code Execute Vulnerability

Exploit Title: Zoo Management System 1.0 - Unauthenticated RCE Exploit Author: Çağatay Ceyhan Vendor Homepage: https://www.sourcecodester.com/php/15347/zoo-management-system-source-code-php-mysql-database.htmlgooglevignette Software Link:...

MikroTik RouterOs Out-of-bounds Read (CVE-2022-45313)

Mikrotik RouterOs before stable v7.5 was discovered to contain an out- of-bounds read in the hotspot process. This vulnerability allows attackers to execute arbitrary code via a crafted nova message. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

CVE-2023-41506

An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file...