231554 matches found
CVE-2024-35109
CVE-2024-35109 affects idccms v1.35 with a CSRF in the component handling /homePro_deal.php?mudi=add&nohrefStr=close (and related variants in the /homePro deal.php path). The issue enables unauthorized requests to be made via forged requests, with user interaction required. A PT-2024-26321 entry ...
CVE-2024-35108
CVE-2024-35108 affects idccms v1.35, with a CSRF flaw exploitable via the admin path /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN. The issue originates from a vulnerable component handling parameters mudi, dataType, and dataTypeCN in the admin module, enabling unauthorized requests. The ...
CVE-2024-4199
CVE-2024-4199 concerns the Bulk Posts Editing For WordPress plugin (all versions up to 4.2.3) with a missing capability check on AJAX actions, allowing authenticated users with subscriber+ privileges to invoke plugin functions. The Wordfence entry states unauthorized access could enable post crea...
CVE-2024-4618
CVE-2024-4618 affects Exclusive Addons for Elementor (WordPress). Root cause: insufficient sanitization of the Team Member widget’s url attribute and output escaping, allowing stored XSS. Impact: authenticated users with contributor+ privileges can inject scripts that execute on pages viewed by o...
Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2024-1641)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-33327
CVE-2023-33327 refers to a high-severity Privilege Escalation in the WordPress Leyka plugin (versions
CVE-2024-3044
CVE-2024-3044 concerns LibreOffice: Unchecked script execution in Graphic on-click binding allows a document to trigger built-in scripts when clicking a graphic, previously treated as trusted but now untrusted. The vulnerability affects multiple LibreOffice builds across distributions, with remed...
CVE-2024-31556
CVE-2024-31556 affects Reportico Web prior to version 8.1.0. The issue allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function, indicating a local-privilege or local-code execution risk. The vulnerability is described in multiple sources as af...
CVE-2021-22280
CVE-2021-22280 крат: B&R Automation Studio versions 4.0–4.11 suffer from improper DLL loading, enabling an authenticated local attacker to execute code in the product context. The issue is confirmed across multiple sources (PT-2024-10875, Red Hat/NVD records). Impact is local code execution with ...
CVE-2024-0862
The CVE-2024-0862 entry concerns the Proofpoint Encryption endpoint in Proofpoint Enterprise Protection. A Server-Side Request Forgery exists that lets an authenticated user relay HTTP requests from the Protection server to internal, private network addresses. Affected component: Proofpoint Encry...
CVE-2024-33485
CASAP Automated Enrollment System, version V1.0, contains a SQL Injection in the login.php component (PHP/MySQLi) that could allow a remote attacker to leak sensitive information. Root cause: improper handling of user input in SQL queries. Mitigation in the connected document: disable the login f...
CVE-2024-4776
CVE-2024-4776 affects Firefox prior to 126, where a full-screen file dialog could leave the window disabled. Impact is limited to the UI state of the file picker, with no broader exploit details provided. According to the sources, Firefox versions 126 and later (including ESR) include the fix; up...
CVE-2024-4778
CVE-2024-4778 maps to memory-safety bugs in Firefox 125 that affect Firefox versions earlier than 126. The connected security bulletins note memory-corruption evidence and the potential for arbitrary code execution, with affected products including Firefox 125 (and Firefox ESR 115.10) prior to up...
CVE-2024-4775
CVE-2024-4775 affects Mozilla Firefox prior to 126. The issue is an missing iterator stop condition when handling WASM code in the built-in profiler, potentially causing invalid memory access and undefined behavior. Affected product: Firefox (pre-126). Root cause: incomplete iterator termination ...
CVE-2024-4766
Firefox for Android is affected by CVE-2024-4766, which describes techniques used to obscure the fullscreen notification, potentially leading to user confusion and spoofing. The issue affects Firefox
CVE-2024-4770
CVE-2024-4770 is a memory-safety use-after-free issue in PDF rendering when saving a page to PDF, reported for Firefox <126, Firefox ESR <115.11, and Thunderbird
CVE-2024-4769
CVE-2024-4769 : In Firefox and Thunderbird, Web Workers handling could reveal cross-origin information by distinguishing between responses with the content-type application/javascript vs non-script types. This could lead to information disclosure across origins. Affected products are Firefox befo...
CVE-2024-4367
CVE-2024-4367 concerns a missing type check when handling fonts in PDF.js, allowing arbitrary JavaScript execution within the PDF.js context. Affected products listed in connected docs include Firefox before 126, Firefox ESR before 115.11, and Thunderbird before 115.11. The root cause is limited ...
CVE-2024-27110
CVE-2024-27110 is an elevation-of-privilege vulnerability in GE HealthCare EchoPAC products. Public docs describe EchoPAC (and related EchoPAC-associated workstations) as affected; the underlying root cause and specific vulnerable components/versions are not detailed in the provided sources. The ...