231587 matches found
CVE-2024-35627
TileServer-GL up to v4.4.10 is affected by a cross-site scripting (XSS) vulnerability via the /data/v3/?key component. The issue enables injection of malicious scripts and is described in the Nuclei template and CVE record as affecting tileserver-gl with potential impact to user sessions or sensi...
CVE-2024-25738
Vulnerability summary : Open Library Foundation VuFind versions 2.0–9.1 before 9.1.1 have a Server-Side Request Forgery (SSRF) in the /Upgrade/FixConfig route. The issue lets a remote attacker overwrite local configuration files and could lead to Remote Code Execution, enabled when allow_url_incl...
CVE-2024-31904
IBM App Connect Enterprise integration nodes (AdminAPI) are affected by CVE-2024-31904. An authenticated user could cause a denial of service due to an uncaught exception. Affected versions include 11.0.0.1–11.0.0.25 and 12.0.1.0–12.0.12.0. IBM’s bulletin describes remediation: upgrade to App Con...
CVE-2024-21791
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability...
CVE-2023-20239
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-4563
The CVE-2024-4563 entry concerns Progress MOVEit Automation: the configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. Reported impact in the sources aligns with potential Confidentiality impact (C:H) per CVSS, with the attack vector/network and...
CVE-2024-20355
CVE-2024-20355 affects Cisco ASA/FTD SAML SSO. The issue stems from improper separation of authorization domains, allowing an authenticated remote user to reuse a SAML token to access a tunnel group they are not authorized for, enabling a remote VPN session to secured networks behind the device. ...
CVE-2024-20363
CVE-2024-20363 affects multiple Cisco products due to a vulnerability in the Snort 3 IPS rule engine caused by incorrect HTTP packet handling. An unauthenticated, remote attacker can exploit crafted HTTP traffic to bypass configured IPS rules, allowing uninspected traffic onto the network. Affect...
CVE-2024-33224
An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...
CVE-2024-33225
An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtekr High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...
CVE-2024-35362
Ecshop 3.6 is vulnerable to Cross Site Scripting XSS via ecshop/articlecat.php...
CVE-2024-34448
Ghost before 5.82.0 allows CSV Injection during a member CSV export...
CVE-2024-29392
Silverpeas Core 6.3 is vulnerable to Cross Site Scripting XSS via ClipboardSessionController...
CVE-2024-35362
Ecshop 3.6 is affected by a Cross-Site Scripting (XSS) flaw in ecshop/article_cat.php. Multiple sources (NVD, Red Hat, CVE records) confirm a reflective XSS issue reported for Ecshop 3.6. The CVSS v3.1 base score is 5.4 (Medium) with Network attack vector, required Privileges and User Interaction...
CVE-2024-33224
A security vulnerability exists in the rtkio64.sys component of the Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 . An attacker can exploit this flaw by sending crafted IOCTL requests to achieve privilege escalation and execute arbitrary code . No specific remediation steps or exp...
CVE-2024-5159
CVE-2024-5159 is a heap buffer overflow in ANGLE within Google Chrome (and Chromium-based products) prior to 125.0.6422.76. The vulnerability allows a remote attacker to cause an out-of-bounds memory read via a crafted HTML page. Affected component: ANGLE (graphics/shader translation layer) used ...
CVE-2024-33219
The ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver (version v1.0.1.0 ) is vulnerable due to an issue in the AsIO64.sys component. This security flaw allows an attacker to escalate privileges and execute arbitrary code by sending crafted IOCTL requests . While no patch is currently available, it ...
CVE-2024-3926
CVE-2024-3926 affects Element Pack Elementor Addons for WordPress (bdthemes-element-pack-lite). Vulnerability: Stored XSS via custom_attributes in widgets, exploitable by authenticated users with Contributor+ on versions