CVE-2024-37297

CVE-2024-37297 affects WooCommerce on WordPress. An XSS flaw introduced in 8.8 can be triggered by crafting a link that injects HTML/JavaScript into classic checkout and registration forms via Sourcebuster.js, potentially allowing an attacker to hijack browser content and session data. The vulner...

GHSA-CC97-G92W-JM65 TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution

Phar files formerly known as "PHP archives" can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt...

CVE-2024-5367

A vulnerability was found in Kashipara College Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file eachextracurriculaactivities.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The...

PT-2024-29018 · Unknown · Kashipara Online Furniture Shopping Ecommerce Website

Name of the Vulnerable Software and Affected Versions: Kashipara Online Furniture Shopping Ecommerce Website version 1.0 Description: A vulnerability was found in the file prodInfo.php, where the manipulation of the prodId argument leads to cross site scripting. The attack may be launched remotel...

GHSA-HVP5-5X4F-33FQ JADX file override vulnerability

Summary when jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result. Although I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway Detai...

OpenClinic GA 5.247.01 - Information Disclosure Vulnerability

Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Link: https://sourceforge.net/projects/open-clinic/ Version: OpenClinic GA 5.247.01 Tested on: Windows 10, Windows 11 CVE: CVE-2023-40278 Details An Information...

CVE-2024-3766 slowlyo OwlAdmin Image File Upload upload_image cross site scripting

A vulnerability, which was classified as problematic, has been found in slowlyo OwlAdmin up to 3.5.7. Affected by this issue is some unknown functionality of the file /admin-api/uploadimage of the component Image File Upload. The manipulation of the argument file leads to cross site scripting. Th...

CVE-2024-3463

A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /karyawan/edit. The manipulation of the argument karyawan leads to cross site scripting. The attack can be initiated remotely. The...

Path Traversal

webpack-dev-middleware is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of URL addresses, allowing attackers to access any file on the developer's machine by manipulating the URL with specific encoded sequences such as %2e or %2f...

CVE-2024-2150

A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to t...

Design/Logic Flaw

A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to t...

Cross site scripting

A vulnerability, which was classified as problematic, was found in Bdtask Isshue Multi Store eCommerce Shopping Cart Solution 4.0. This affects an unknown part of the file /dashboard/Cinvoice/manageinvoice of the component Manage Sale Page. The manipulation of the argument Title leads to cross si...

Design/Logic Flaw

A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the...

Cross site scripting

A vulnerability classified as problematic has been found in PbootCMS 3.2.5-20230421. Affected is an unknown function of the file /admin.php?p=/Area/indextab=t2. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-0891

A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input alertdocument.cookie leads to cross site scripting. The attack can be launched remotely...

CVE-2024-23655

CVE-2024-23655 affects Tuta (encrypted email service). A manipulation in emails sent to versions 3.118.12 through 3.119.9 can render the app unusable, preventing access to received emails on both the app and web interfaces. The issue has been fixed in version 3.119.10. In practice, an attacker co...

CVE-2024-23655 Attacker can prevent users from accessing received emails

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

CVE-2024-23655 Attacker can prevent users from accessing received emails

Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusab...

PT-2024-20004 · Tuta · Tuta

Name of the Vulnerable Software and Affected Versions: Tuta versions 3.118.12 through 3.119.9 Description: Tuta is an encrypted email service. An attacker can send a manipulated email to put the app into an unusable state, preventing the user from accessing received emails. This issue affects not...

PT-2024-13033 · Allterco · Shelly Trv

Name of the Vulnerable Software and Affected Versions: Shelly TRV version 20220811-152343/v2.1.8@5afc928c Description: The issue allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is then...