CVE-2024-48624

In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting XSS vulnerability...

itsourcecode Online Tours and Travels Management System 安全漏洞

itsourcecode Online Tours and Travels Management System is itsourcecode open source an online travel management system . A security vulnerability exists in itsourcecode Online Tours and Travels Management System v1.0, which originates from a SQL injection vulnerability in the val-email parameter ...

CVE-2024-48623

In queue\index.php of DomainMOD below v4.12.0, the listid and domainid parameters in the GET request can be exploited to cause a reflected Cross Site Scripting XSS...

CVE-2024-48623

In queue\index.php of DomainMOD below v4.12.0, the listid and domainid parameters in the GET request can be exploited to cause a reflected Cross Site Scripting XSS...

PT-2024-11911 · Freemius · Freemius Sdk

Name of the Vulnerable Software and Affected Versions: Freemius SDK versions up to, and including 2.4.2 Freemius SDK versions prior to 2.4.3 Description: The issue concerns Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the...

VulnCheck KEV: CVE-2022-4974

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the getdebuglog, getdboption, and the setdboption functions in versions up...

CVE-2024-48153

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getsubconfig function...

WordPress Elementor plugin <= 3.24.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt function vulnerability

Authenticated Contributor+ Basic Information Exposure via getimagealt function vulnerability discovered by stealthcopter in WordPress Plugin Elementor Website Builder versions = 3.24.5...

MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed

...

PT-2024-37853 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin for WordPress versions up to, and including, 3.23.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract either excerpt data or titles of private or...

DrayTek Vigor 3900 安全漏洞

DrayTek Vigor 3900 is a high performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor 3900 version 1.5.1.3. An attacker can exploit this vulnerability to inject malicious commands into mainfunction.cgi and execute arbitrary commands by...

Wavelog 安全漏洞

Wavelog is a web-based amateur radio logging software from Wavelog Open Source. A security vulnerability exists in Wavelog version 1.8.5, which stems from an SQL injection vulnerability contained in the stationid parameter in the getworkedmodes function on the Oqrsmodel.php page...

Wavelog 安全漏洞

Wavelog is a web-based amateur radio logging software from Wavelog Open Source. A security vulnerability exists in Wavelog version 1.8.5, which stems from allowing Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...

Wavelog 安全漏洞

Wavelog is a web-based amateur radio logging software from Wavelog Open Source. A security vulnerability exists in Wavelog version 1.8.5, which stems from a Gridmapmodel.php getbandconfirmed SQL injection that allows Gridmapmodel.php getbandconfirmed via band, sat, propagation, or mode...

PT-2024-33007 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get subconfig function. Recommendations: For DrayTek Vigor3900 version...

PT-2024-33055 · Wavelog · Wavelog

Name of the Vulnerable Software and Affected Versions: Wavelog version 1.8.5 Description: The issue allows SQL injection via the band, sat, propagation, or mode variables in the get band confirmed function of Gridmap model.php. This can potentially lead to unauthorized access or manipulation of...

Cloudlog 安全漏洞

Cloudlog is a self-hosted PHP application by the individual developer Peter Goodhall. Allows logging of amateur radio contacts from anywhere. A security vulnerability exists in Cloudlog version 2.6.15 that stems from allowing SQL injection via the stationid parameter of Oqrs.php getstationinfo...

wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()

...

CVE-2024-47508

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon evo-pfemand of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service DoS.When specific SNMP GET operations or specifi...

CVE-2024-47505 Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #1

An Allocation of Resources Without Limits or Throttling vulnerability in the PFE management daemon evo-pfemand of Juniper Networks Junos OS Evolved allows an authenticated, network-based attacker to cause an FPC crash leading to a Denial of Service DoS.When specific SNMP GET operations or specifi...