CVE-2024-47730

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Unreliable Remote Version Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-8983

Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SAP Commerce 跨站脚本漏洞

SAP Commerce Backoffice is a powerful tool for managing and maintaining e-commerce websites, allowing administrators and operations teams to easily manage website content and configuration. SAP Commerce Backoffice suffers from a cross-site scripting vulnerability that can be exploited by remote...

CVE-2024-47854

An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user...

CVE-2024-41516

A Reflected cross-site scripting XSS vulnerability in "ccHandler.aspx" CADClick = 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "bomid" parameter...

CVE-2024-41513

A reflected cross-site scripting XSS vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbitrary web script or HTML via the "searchindex" parameter...

Synology DiskStation Manager Improper Neutralization of Input During Web Page Generation (CVE-2017-16774)

Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter. This plugin only works with Tenable.ot. Please visit...

CVE-2024-8515

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like 'TF E Slider Widget', 'TF Video Widget', 'TF Team Widget' and more in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping ...

CVE-2024-8914

CVE-2024-8914 affects the WordPress plugin Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay and 40 Vietnamese banks, vulnerable to unauthenticated Stored XSS in all versions up to 2.0.1 due to incorrect use of wp_kses_allowed_html, permitting onclick on certain elements. Public detail...

CVE-2024-45612

Vulnerability summary: CVE-2024-45612 affects Contao CMS. An untrusted user can inject insert tags into canonical URLs, which are then evaluated and rendered on the front end. Affected product/version (as per sources): Contao 4.13 up to 4.13.48; Contao 5.0–5.4.x up to 5.3.14 and 5.4.2, with fixes...

Fedora: Security Advisory (FEDORA-2023-7398c7b4db)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZZCMS caina.php Cross-Site Scripting Vulnerability

ZZCMS is a content management system by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS caina.php handling HTTPReferer, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack us...

PT-2024-32203

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.9 Description The issue arises when PG hwpoison pages are freed and treated differently in free pages prepare, leading to isolation instead of release. Page allocation tag counters are decremented, consideri...

CVE-2024-41613

A Cross Site Scripting XSS vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing note...

MAL-2024-12331 Malicious code in pydevd-inject (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a67732a19f213875b774ca8fb24e8d3c1c3cd9d357cf7e6425a3ee3eadb9f3a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2024-6778

Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: High...

CVE-2024-6778

Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: High...

CVE-2024-28749

A remote attacker with high privileges may use a writing file function to inject OS commands...

CVE-2024-6405

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floatingsocialbuttonsoption function. This makes it possible for unauthenticated attackers to update...