290 matches found
PT-2024-17015 · WordPress · Debounce Email Validator
Name of the Vulnerable Software and Affected Versions: DeBounce Email Validator plugin for WordPress versions up to, and including, 5.6.5 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...
PT-2024-16324 · Klokan Maptiler · Tileserver-Gl
Name of the Vulnerable Software and Affected Versions: Klokan MapTiler tileserver-gl version 2.3.1 Description: A vulnerability was found in the component URL Handler of Klokan MapTiler tileserver-gl, which can lead to cross-site scripting when the key argument is manipulated. This issue can be...
CVE-2024-48634
D-Link DIR-882 (dual-band wireless router) and DIR-878 (wireless router) devices are susceptible to a command injection vulnerability. The flaw exists within the SetWlanRadioSecurity() function in the prog.cgi script of the router's microprogramming software. It is caused by a failure to neutrali...
CVE-2024-48634: Improper Neutralization of Special Elements used in an OS Command
D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...
WordPress WP Easy Gallery plugin <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter vulnerability
Authenticated Contributor+ SQL Injection via key Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Easy Gallery versions = 4.8.5...
CVE-2024-9018: Improper Neutralization of Special Elements used in an SQL Command
The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...
PT-2024-7034 · D Link · D-Link Dir-878 +1
Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions FW130B06 D-Link DIR-878 versions FW130B08 Description: A command injection issue exists in the SetWLanRadioSecurity function due to insufficient neutralization of special elements used in an OS command. This allows...
PT-2024-32043 · Draytek · Draytek Vigor 3910
Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow issue was discovered in the pub key parameter at the "v2x00.cgi" endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations: Fo...
DrayTek Vigor 3910 安全漏洞
DrayTek Vigor 3910 is a high performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor 3910 version v4.3.2.6 that originates from a buffer overflow issue contained in the pubkey parameter of the v2x00.cgi page. An attacker can cause a deni...
CVE-2024-46560
CVE-2024-46560 affects Draytek Vigor 3910 (version 4.3.2.6). The root cause is a buffer overflow in the pub_key parameter handled by the v2x00.cgi endpoint, leading to Denial of Service. Public sources in the provided documents confirm the affected software and vulnerable component, and several t...
PT-2024-22975 · Sportsnet · Sportsnet
Name of the Vulnerable Software and Affected Versions: SportsNET version 4.0.1 Description: The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query. The vulnerable API...
CVE-2024-41444
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so...
CVE-2024-41444: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so...
PT-2024-29404
Name of the Vulnerable Software and Affected Versions SeaCMS versions 11.3 through 12.9 Description The issue is a SQL injection vulnerability in the key parameter of the "/js/player/dmplayer/dmku/index.php?ac=so" endpoint. This vulnerability can be exploited to inject malicious SQL code. Users a...
WordPress plugin Post Meta Data Manager Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
The vulnerabilities of the functions EVP_PKEY_param_check() and EVP_PKEY_public_check() in the OpenSSL cryptographic library allow a attacker to cause a service failure.
The vulnerability of the EVPPKEYparamcheck and EVPPKEYpubliccheck functions in the OpenSSL cryptographic library is related to uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
EulerOS Virtualization 3.0.6.0 : shim (EulerOS-SA-2024-1706)
According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to...
AZL-78534 CVE-2024-4603 affecting package openssl-fips-provider 3.1.2-2
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVPPKEYparamcheck or EVPPKEYpubliccheck to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked...
