FATEK FvDesigner 安全漏洞

FATEK FvDesigner is a hardware device from the Chinese company Yonghong Electric FATEK. It provides a human-machine interface. A security vulnerability exists in FATEK FvDesigner that stems from a lack of proper validation of user-supplied data. An attacker can exploit the vulnerability to execut...

PT-2024-25586 · Unknown · Atanas Yonkov Pliska

Name of the Vulnerable Software and Affected Versions: Atanas Yonkov Pliska versions 0.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-25587 · Unknown · Freesia Empire

Name of the Vulnerable Software and Affected Versions: Freesia Empire versions 1.4.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

PT-2024-25584 · Unique · Unique

Name of the Vulnerable Software and Affected Versions: Unique versions 0.3.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts into the website,...

PT-2024-31131 · Unknown · Mr Digital Simple Image Popup

Name of the Vulnerable Software and Affected Versions: Mr Digital Simple Image Popup versions n/a through 2.4.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can injec...

CVE-2024-4142 JFrog Artifactory Improper input validation within token creation flow

An Improper input validation vulnerability that could potentially lead to privilege escalation was discovered in JFrog Artifactory. Due to this vulnerability, users with low privileges may gain administrative access to the system. This issue can also be exploited in Artifactory platforms with...

ASB-A-293602970

In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2024-003)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2024-003 advisory. Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an...

CVE-2024-33537

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Theme Horse WP Portfolio allows Stored XSS.This issue affects WP Portfolio: from n/a through 2.4...

PT-2024-25390 · Elementor · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor versions 2.4.26 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicio...

IBM MQ 9.2 <= 9.2.0.25 / 9.3 < 9.3.5 CD / 9.3 <= 9.3.0.17 (7123135)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7123135 advisory. - Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse function. When n...

Improper Input Validation

vyper is vulnerable to Improper Input Validation. The vulnerability is caused by improper handling of memory or storage arguments in the rawlog builtin, which results in incorrect values being logged when these arguments are used as topics...

WordPress plugin Annual Archive 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Meks Smart Social Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin Fan Page Widget by ThemeNcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin Fan Pag...

CLSA-2024-1714066065 Fix CVE(s): CVE-2024-3096

SECURITY UPDATE: improper handling of user input vulnerability - debian/patches/CVE-2024-3096.patch: Disallow null character in bcrypt password to prevent passwordverify from erroneously returning true - CVE-2024-3096...

CVE-2024-4175 Improper Input Validation vulnerability in Hyperion Web Server

Unicode transformation vulnerability in Hyperion affecting version 2.0.15. This vulnerability could allow an attacker to send a malicious payload with Unicode characters that will be replaced by ASCII characters...

Security Bulletin: IBM Event Processing is vulnerable to conduct phishing attacks, caused by an open redirect vulnerability (CVE-2023-26159).

Summary There is a vulnerability in follow-redirects used by IBM Event Processing which is categorized as an Improper Input Validation vulnerability due to the improper handling of URLs by the url.parse function. This vulnerability can be exploited by manipulating the hostname when new URL throws...

VulnCheck KEV: CVE-2024-33571

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through = 1.5.6...

WordPress theme UDesign 跨站脚本漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on PHP and MySQL servers.WordPress theme is a theme for WordPress. A cross-site scripting vulnerability exists in WordPress theme UDesign version 4.7.3 and prior versions, whic...