CVE-2024-37474: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Automattic Newspack Ads allows Stored XSS.This issue affects Newspack Ads: from n/a through 1.47.1...

CVE-2024-5672 Red Lion Europe: mbNET.mini vulnerable to OS command injection

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command...

CVE-2024-5672

CVE-2024-5672 affects MB Connect Line mbNET.mini (industrial router) up to version 2.2.11, with the issue caused by improper neutralization of special elements in OS commands. This enables a high-privileged, authenticated attacker to inject and execute arbitrary system commands via GET requests, ...

CVE-2024-38857

CVE-2024-38857 affects Checkmk prior to versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL). The issue is improper neutralization of input in Checkmk that allows attackers to craft malicious links, enabling phishing attacks. Reported impact notes include user interaction required and potential ...

CVE-2024-38857: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 EOL allows attackers to craft malicious links that can facilitate phishing attacks...

GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security...

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update E)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.0 ATTENTION : Exploitable remotely Vendor : ICONICS, Mitsubishi Electric Equipment : ICONICS Product Suite Vulnerabilities : Allocation of Resources Without Limits or Throttling, Improper Neutralization, Uncontrolled Search Path Element, Improper...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

PT-2024-27410

Name of the Vulnerable Software and Affected Versions jQuery T- Countdown Widget versions n/a through 2.3.25 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in the jQuery T- Countdo...

CVE-2024-4957: Improper Neutralization of Input During Web Page Generation

The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

LocalAI Operating System Command Injection Vulnerability

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An OS command injection vulnerability exists in localai version 2.14.0, which stems from improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrar...

CVE-2024-4639: Improper Neutralization of Special Elements used in a Command

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands...

CVE-2024-31111: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6,...

CVE-2024-4754: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Next4Biz CRM & BPM Software Business Process Manangement BPM allows Stored XSS. This issue affects Business Process Manangement BPM: from 6.6.4.4 before 6.6.4.5...

CVE-2024-35768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows DOM-Based XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22...

CVE-2024-35757

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in 5 Star Plugins Easy Age Verify allows Stored XSS.This issue affects Easy Age Verify: from n/a through 1.8.2...

CVE-2024-35774

CVE-2024-35774: Stored XSS in D’arteweb DImage 360 (DImage 360) due to improper neutralization of input during web page generation; affects DImage 360 versions up to 2.0. The issue is a stored cross-site scripting vulnerability; the root cause is incorrect handling of user input in page rendering...

CVE-2024-35779

CVE-2024-35779 is an XSS vulnerability described as Stored XSS in Live Composer Page Builder (WordPress plugin) affecting versions from n/a up to 1.5.42. The connected records corroborate a Live Composer vulnerability and identify the issue type as Stored XSS for this CVE; exploitation details ar...

PT-2024-26720

Name of the Vulnerable Software and Affected Versions WPPizza versions 3.18.13 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations For versions 3.18.13 a...

CVE-2024-35762: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Cryout Creations Serious Slider allows Stored XSS.This issue affects Serious Slider: from n/a through 1.2.4...