231585 matches found
CVE-2024-5223
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploading feature in all versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2024-3190
The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's text field widget in all versions up to, and including, 1.5.107 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-3269
The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlmuninstallplugin function in all versions up to, and including, 4.9.13. This makes it possible for authenticated attackers to uninstall the plugin and delete...
CVE-2024-2253
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-3063
CVE-2024-3063 refers to a Stored Cross‑Site Scripting (XSS) vulnerability in the WPB Elementor Addons WordPress plugin. Affected versions are all ≤ 1.0.9, due to insufficient input sanitization and output escaping on widget tag attributes. Exploitation requires authentication at contributor level...
CVE-2024-3726
The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...
CVE-2024-35434
CVE-2024-35434 affects Irontec Sngrep v1.8.1. A heap buffer overflow in the function rtp_check_packet (file /sngrep/src/rtp.c) can be triggered by a crafted SIP packet, enabling a Denial of Service (DoS) . The CVE is documented with a network-based attack vector and low attack complexity (no priv...
CVE-2024-35512
hmq v1.5.5 is vulnerable to Denial of Service DoS due to a Null Pointer Exception. A remote attacker can trigger a broker crash by sending a specially crafted MQTT UNSUBSCRIBE packet with an illegal control character Topic. The failure to properly validate this field leads to a null pointer...
CVE-2024-35512
CVE-2024-35512 concerns the hmq v1.5.5 release, where crafted requests can trigger a Denial of Service. Affected component is the hmq process handling requests; the public documents do not disclose the exact root cause. Reported impact is DoS with low attack complexity and no data confidentiality...
CVE-2024-35333
A stack-buffer-overflow vulnerability exists in the readcharsetdecl function of html2xhtml 1.3. This vulnerability occurs due to improper bounds checking when copying data into a fixed-size stack buffer. An attacker can exploit this vulnerability by providing a specially crafted input to the...
CVE-2024-35200
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate...
CVE-2024-32760
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact...
CVE-2024-35200
CVE-2024-35200 affects NGINX Plus and NGINX Open Source when the HTTP/3 QUIC module (ngx_http_v3_module) is enabled. The underlying issue causes NGINX worker processes to terminate after undisclosed HTTP/3 requests, resulting in a denial-of-service. Affected versions (per connected advisories) in...
CVE-2024-32760
CVE-2024-32760 affects NGINX Plus and NGINX Open Source when using the HTTP/3 QUIC module (ngx_http_v3_module). The root cause is undisclosed or unspecified HTTP/3 encoder instructions that can cause NGINX worker processes to terminate, leading to DoS or other impact. Observed impact in the conne...
CVE-2024-35311
CVE-2024-35311 affects Yubico YubiKey 5 Series <5.7.0, Security Key Series <5.7.0, YubiKey Bio Series <5.6.4, and YubiKey 5 FIPS
CVE-2024-28974
CVE-2024-28974 concerns Dell Data Protection Advisor (DP A) 19.9 with an inadequate encryption strength vulnerability. A low-privileged, remote attacker could exploit this to cause a Denial of Service. Documents consistently identify the affected component as DP A 19.9 and describe the root cause...
CVE-2024-4358
In Progress Telerik Report Server, version 2024 Q1 10.0.24.305 or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability...
CVE-2024-36375
In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed...