CVE-2024-53814

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Analytify.This issue affects Analytify: from n/a through 5.4.3...

WordPress plugin Poll Maker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

OESA-2024-2516 wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. For version 5.0.0, several new file formats and lossless DSD audio compression were added, making WavPack a universal audio archiving solution. Security Fixes: A nul...

CVE-2024-53844 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddi

E.D.D.I Enhanced Dialog Driven Interface is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export functionality of EDDI, as implemented in RestExportService.java. This vulnerability allows an attacker to access sensitive files on the server by...

PT-2024-35421 · Crmeb · Crmeb

Name of the Vulnerable Software and Affected Versions: CRMEB version 5.4.0 Description: The issue allows an attacker to obtain sensitive information through an arbitrary file read in the save basics function. Recommendations: For CRMEB version 5.4.0, consider restricting access to the save basics...

assimp 安全漏洞

assimp is an assimp open source library. It is used to import and export various 3D model formats. A security vulnerability exists in version 5.4.3 of assimp, which stems from the presence of a heap buffer overflow vulnerability that can lead to out-of-bounds reads and potential application crash...

WordPress Chameleoni Jobs plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Chameleoni Jobs versions = 2.5.4...

PT-2024-34381 · Crmeb · Crmeb

Name of the Vulnerable Software and Affected Versions: CRMEB versions prior to 5.4.0 Description: The issue allows users to bypass the front-end restriction of only being able to claim coupons once. This can be achieved by capturing packets and sending a large number of data packets for coupon...

WordPress Poll Maker plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection vulnerability

Authenticated Administrator+ Time-Based SQL Injection vulnerability discovered by tmrswrr in WordPress Plugin Poll Maker versions = 5.4.6...

PT-2024-33625 · Unknown · Latex2Html

Name of the Vulnerable Software and Affected Versions: LaTeX2HTML versions n/a through 2.5.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For versio...

WordPress Auto Amazon Links plugin <= 5.4.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Auto Amazon Links versions = 5.4.2...

PT-2024-39584 · WordPress · Auto Amazon Links – Amazon Associates Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress versions up to, and including, 5.4.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate...

PT-2024-31859

Name of the Vulnerable Software and Affected Versions Contao version 5.4.1 Description The issue allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site...

CVE-2024-9265

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echocheckpostheadersent function. This makes it possib...

OESA-2024-2194 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: Heap-based buffer overflow...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

PT-2024-31222 · Autocms · Autocms

Name of the Vulnerable Software and Affected Versions: AutoCMS version 5.4 Description: The issue allows attackers to execute arbitrary PHP code via injecting a crafted value into the txtsite url parameter at the "/admin/site add.php" API endpoint. This enables attackers to inject malicious PHP...

QNAP Systems Music Station 授权问题漏洞

QNAP Systems Music Station is a music playback and management application from QNAP Systems. An authorization issue vulnerability exists in QNAP Systems Music Station version 5.4.0 and prior versions, which stems from the inclusion of an incorrect authentication vulnerability. An attacker...

PT-2024-30245 · Mcms · Mcms

Name of the Vulnerable Software and Affected Versions: MCMS version 5.4.1 Description: The issue is related to a front-end file upload vulnerability in MCMS, which can lead to remote command execution. This allows an attacker to execute commands remotely. Recommendations: For MCMS version 5.4.1,...

MingSoft MCMS 安全漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingFei MingSoft. A security vulnerability exists in MingSoft MCMS version v5.4.1, which stems from improper handling of the front-end file upload function, and could lead to remote command execution...