231579 matches found
CVE-2023-45590
Fortinet FortiClientLinux contains an improper control of code generation (CWE-94) that can lead to remote code execution when a user visits a malicious website. Affected versions include FortiClientLinux 7.0.3–7.0.4, 7.0.6–7.0.10, and 7.2.0. Fortinet’s advisories and vendor-sec patches recommend...
CVE-2024-23662
CVE-2024-23662 is an information-disclosure vulnerability in Fortinet FortiOS that affects FortiOS versions 6.4.0–6.4.15, 7.0.0–7.0.15, 7.2.0–7.2.5, and 7.4.0–7.4.1, enabling an unauthenticated attacker to access sensitive data via HTTP requests. Connected sources provide concrete version ranges ...
CVE-2023-49906
CVE-2023-49906 is a stack-based buffer overflow in the TP-Link AC1350 (EAP225 V3) web interface, specifically in the httpd_portal function handling the scheduling/ssid parameter. A crafted authenticated HTTP POST to /data/scheduler.association.json can overflow the stack via multiple input buffer...
CVE-2023-49909
Talos reports a stack-based buffer overflow in Tp-Link AC1350 (EAP225 V3) Web UI, specifically in the Radio Scheduling endpoint. The vulnerability (CVE-2023-49909) is triggered by crafted POST requests to /data/scheduler.association.json with operation not equal to read or load (commonly operatio...
CVE-2023-49912
CVE-2023-49912 describes a stack-based buffer overflow in the TP-Link AC1350 series (EAP225 V3) and EAP115 web interfaces, exposed through the Radio Scheduling feature. The vulnerability exists in the POST endpoint /data/scheduler.association.json, where an authenticated HTTP request with a craft...
CVE-2024-28234
Contao is affected when BBCode is enabled for comments, allowing CSS injection via BBCode in user comments. The issue affects Contao 2.0.0 and earlier, and versions prior to 4.13.40 and 5.3.4. Patch versions are Contao 4.13.40 and 5.3.4, which fix the vulnerability. As a workaround, disable BBCod...
CVE-2024-2224
CVE-2024-2224 affects Bitdefender GravityZone UpdateServer and related products: Linux endpoint 7.0.5.200089, Windows endpoint 7.9.9.380, GravityZone Control Center On Premises 6.36.1. The issue is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in the UpdateServer...
CVE-2021-28656
CVE-2021-28656 corresponds to a CSRF issue in the Credential page of Apache Zeppelin (affected versions: 0.9.0 and prior). The root cause cited across sources is inadequate validation of requests, enabling an attacker to submit malicious requests (e.g., via phishing). Several connected documents ...
CVE-2024-31370
CVE-2024-31370 is an authenticated SQL Injection in AIKit (WordPress) affected
CVE-2024-30191
CVE-2024-30191 (and related entries CVE-2022-47522 lineage) affects Siemens SCALANCE W700/W721/W722/W734/W738/W748/W761/W774/W778/W786/WAM/WUM/WUM766 family and similar models, describing an override of a victim’s security context in 802.11 frames. The root cause: an attacker physically nearby ca...
CVE-2024-31369
The CVE-2024-31369 entry describes a CSRF vulnerability in the PenciDesign Soledad WordPress theme, affecting Soledad versions from n/a up to 8.4.2. The provided metrics (CVSS 3.1) indicate a base score of 5.4 (Medium) with impact on integrity/availability at LOW, confidentiality not impacted, in...
CVE-2023-1082
CVE-2023-1082 affects Welotec TK500/ TK500v1 router series. A remote attacker with low privileges can perform a command injection that may lead to root access. Public documentation in multiple feeds confirms the vulnerability exists in industrial routers and describes the impact as remote command...
CVE-2024-31368
CVE-2024-31368 is a Missing Authorization vulnerability in the PenciDesign Soledad WordPress theme, affecting Soledad builds up to 8.4.2 (and noted as affected from n/a to 8.4.2 in the initial document). Connected sources confirm this is a real issue with the Soledad theme, and Red Hat/Wordfence ...
CVE-2024-31365
CVE-2024-31365 is a Reflected XSS in Themify Post Type Builder (PTB). The issue affects PTB versions before 2.1.1; root cause is improper input handling during web page generation. CVSS vector indicates NETWORK access, LOW confidentiality/integrity/availability impact, UI interaction required, an...
CVE-2024-1664
CVE-2024-1664 affects the WordPress plugin Responsive Gallery Grid (versions prior to 2.3.11). The vulnerability arises from insufficient sanitisation/escaping of several settings, which could allow high-privilege users (e.g., administrators) to perform Stored XSS, including in multisite configur...
Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server
This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...
CVE-2024-2975
CVE-2024-2975 describes a race condition enabling privilege escalation in Octopus Server (Octopus Deploy) configurations. Publicly documented by CNNVD as affecting Octopus Server versions prior to 2024.1.12087; other sources reiterate the privilege escalation impact without specifying exploit det...
CVE-2024-30681
CVE-2024-30681 entry is rejected/not used; it does not represent an active vulnerability entry.
CVE-2024-31506
The CVE concerns Sourcecodester Online Graduate Tracer System v1.0, where the vulnerability is an SQL Injection in the admin/admin_cs.php file triggered by the id parameter. Affected component is the web application’s admin interface; underlying cause is improper handling of the id input leading ...