231585 matches found
CVE-2024-3557
The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up to, and including, 9.0.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...
CVE-2024-5205
The Videojs HTML5 Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videojsvideo shortcode in all versions up to, and including, 1.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-5279
The CVE-2024-5279 entry affects Qiwen Netdisk up to version 1.4.0, with a vulnerability in the File Rename Handler that allows stored cross-site scripting via a crafted file name. The attack vector is network-based and can be triggered remotely; it uses an input such as , and the vulnerability is...
CVE-2024-5298
D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existi...
CVE-2024-5246
NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific...
CVE-2024-5247
CVE-2024-5247 affects NETGEAR ProSAFE Network Management System. The UpLoadServlet unsafely handles user-supplied data, allowing unrestricted file uploads that can lead to remote code execution with SYSTEM privileges. Authentication is required to exploit, and multiple sources (ZDI advisories, NV...
CVE-2024-5246
CVE-2024-5246 affects NETGEAR ProSAFE Network Management System. The vulnerability is a Tomcat-based remote code execution in the product installer, caused by a vulnerable Apache Tomcat version. An attacker can execute code with SYSTEM privileges, requiring authentication to exploit. Public detai...
CVE-2024-5245
CVE-2024-5245 — NETGEAR ProSAFE Network Management System involves a local privilege-escalation vulnerability caused by default MySQL credentials in the product installer. An attacker who can run low-privileged code locally can leverage these credentials to escalate privileges to SYSTEM and execu...
CVE-2024-5299
The CVE-2024-5299 entry concerns D-Link D-View, a web-based network device management software. The flaw resides in the execMonitorScript method, due to an exposed dangerous method, enabling remote code execution. Attackers can execute code in the context of root; the advisory notes that authenti...
CVE-2024-5298
Affected product : D-Link D-View. Vulnerability : Remote Code Execution via the exposed dangerous method in the queryDeviceCustomMonitorResult function. The flaw allows an attacker to execute code in the context of root. Although authentication is required, the authentication mechanism can be byp...
CVE-2024-5297
The CVE-2024-5297 issue affects D-Link D-View with a flaw in the executeWmicCmd method. The vulnerability stems from insufficient validation of a user-supplied string before it is used to perform a system call, allowing an attacker to execute code with root privileges on affected installations. A...
CVE-2024-5296
CVE-2024-5296 concerns D-Link D-View, where the TokenUtils class uses a hard-coded cryptographic key, enabling remote authentication bypass on affected installations. Multiple sources (ZDI advisory ZDI-24-447, NVD entry) describe the flaw as a hard-coded key leading to authentication bypass, with...
CVE-2024-5295
CVE-2024-5295 affects the D-Link G416 wireless router. The flaw is a command injection in the HTTP service on TCP port 80, caused by improper validation of a user-supplied string before it is used to execute a system call. This allows network-adjacent attackers to execute arbitrary code with root...
CVE-2024-5294
The CVE-2024-5294 entry concerns the D-Link DIR-3040 router. The vulnerable component is prog.cgi (HNAP handler for the lighttpd server on ports 80/443). The root cause is improper memory management when processing HTTP cookie values, causing a memory leak that enables a denial-of-service conditi...
CVE-2024-5292
CVE-2024-5292 concerns the D-Link Network Assistant. The DNACore service loads a file from an unsecured location, enabling a local attacker who can run low-privileged code to escalate to SYSTEM and execute arbitrary code. Public disclosures (ZDI-24-443, NVD entry) confirm local privilege escalati...
CVE-2024-5201
CVE-2024-5201 describes a privilege escalation in OpenText Dimensions RM where an authenticated user can elevate to another user’s privileges via an HTTP request. The affected product is OpenText Dimensions RM; the underlying root cause and exact exploit path are not detailed in the provided docu...
CVE-2024-35079
Inxedu v2024.4 contains an arbitrary file upload vulnerability in the uploadAudio method, exploitable by uploading a crafted .jsp file to achieve arbitrary code execution. The CVE indicates network access with no authentication is required and impact to confidentiality, integrity, and availabilit...
CVE-2024-35090
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml...