CVE-2024-20333

CVE-2024-20333 affects Cisco Catalyst Center (formerly Cisco DNA Center) web-based management interface. The vulnerability arises from insufficient authorization enforcement, allowing an authenticated, remote attacker to change a specific field in the interface by sending a crafted HTTP request. ...

CVE-2024-2985

CVE-2024-2985 affects Tenda FH1202 on version 1.2.0.14(408). The vulnerability lies in the function formQuickIndex of /goform/QuickIndex, where manipulating the PPPOEPassword argument causes a stack-based buffer overflow. This enables remote initiation and, per sources, an exploit has been disclo...

CVE-2024-29945

CVE-2024-29945 affects Splunk Enterprise: authentication tokens can be exposed during token validation when running in debug mode or JsonWebToken logging at DEBUG. Affected versions are Splunk Enterprise < 9.2.1, < 9.1.4, and

CVE-2024-2984

The CVE-2024-2984 issue affects Tenda FH1202 devices (version 1.2.0.14(408)). The root cause is a stack-based buffer overflow in the formSetCfm function (parameter funcpara1) of the /goform/setcfm endpoint, which can be triggered remotely. Public exploits are referenced in the records. Affected p...

CVE-2024-1540

The CVE-2024-1540 entry describes a command injection in the gradio-app/gradio repository via the deploy+test-visual.yml workflow. The root cause is improper neutralization of special elements in a command, stemming from unsafe handling of GitHub context expressions inside a run step, where ${......

CVE-2024-2979

CVE-2024-2979 affects Tenda F1203 v2.0.1.6: the setSchedWifi function in /goform/openSchedWifi is vulnerable to a stack-based buffer overflow triggered by manipulating schedStartTime/schedEndTime. This enables remote attack with potential arbitrary code execution or crash/DoS; exploitation has be...

CVE-2024-2978

CVE-2024-2978 : A stack-based buffer overflow exists in Tenda F1203 v2.0.1.6, in the function formSetCfm (file /goform/setcfm) caused by improper validation of the funcpara1 parameter. This can be exploited remotely to potentially execute arbitrary code or cause DoS. Public exploit information ex...

CVE-2022-45847

CVE-2022-45847 affects the WordPress Countdown Widget plugin for WordPress. The vulnerability is described as a Cross-Site Request Forgery (CSRF) that leads to Cross-Site Scripting (XSS) and impacts versions from (n/a) through 3.1.9.1. The root cause is CSRF that allows an attacker to induce XSS ...

CVE-2024-23515

CVE-2024-23515 is a CSRF vulnerability in the WordPress plugin Cincopa Post Video Players (versions

CVE-2023-44999

CVE-2023-44999 is a CSRF vulnerability in the WooCommerce Stripe Payment Gateway plugin for WordPress, affecting versions up to 7.6.0. The issue allows an attacker to perform unintended actions by forging requests, with unauthenticated exploitation possible, per Patchstack and Wordfence reference...

CVE-2023-34020

CVE-2023-34020: Open Redirect in Uncanny Toolkit for LearnDash affecting releases

CVE-2024-29760

CVE-2024-29760 is a Reflected XSS in Booster for WooCommerce (Pluggabl LLC) caused by improper neutralization of input during web page generation. Affected: Booster for WooCommerce from baseline (n/a) up to 7.1.7. Potential impact includes execution of scripts in the user’s browser when they inte...

CVE-2024-29767

CVE-2024-29767 is a reflected XSS in the Doneren met Mollie WordPress plugin (Doneren met Mollie) affecting versions from n/a up to 2.10.2. The CVE entry is corroborated by Red Hat's advisory describing improper input neutralization leading to Reflected XSS. CVSSv3.1 base score is 7.1 (HIGH) with...

CVE-2024-29768

CVE-2024-29768 : Stored XSS in Astra (Brainstorm Force) affecting versions up to 4.6.4. Root cause: improper neutralization of input during web page generation. Public details confirm the vulnerability; no remediation/version fix is specified in the provided documents.

CVE-2024-29770

CVE-2024-29770 — Reflected XSS in Pretty Links Shortlinks (Shortlinks by Pretty Links). Affected: Shortlinks plugin up to 3.6.2. Root cause: improper neutralization of input during web page generation. Impact: Low confidentiality, integrity, and availability impact per the CVSS; exploitation requ...

CVE-2024-29775

CVE-2024-29775 affects the Frontend Dashboard WordPress plugin (versions

CVE-2024-29790

CVE-2024-29790 — Reflected Cross-Site Scripting in the WordPress plugin Squirrly SEO Plugin by Squirrly SEO. Affects plugin versions up to 12.3.16 (inclusive). Root cause: improper neutralization of input during web page generation. Exploit details and remediation are not provided in the availabl...

CVE-2024-29776

Technical details for CVE-2024-29776 (Metagauss EventPrime XSS) are not provided in the supplied documents. No vendor/affected version specifics, root cause, impact, or remediation are disclosed here; monitor official advisories for updates.

CVE-2024-29789

CVE-2024-29789 – Stored XSS in Walter Pinem OneClick Chat to Order (WordPress). Affected: OneClick Chat to Order plugin versions from n/a up to 1.0.5. Root cause per description: improper neutralization of input during web page generation. Impact: stored cross-site scripting, enabling injection o...

CVE-2024-29793

CVE-2024-29793 is a Stored XSS in the MailChimp Forms by MailMunch plugin for WordPress (MailChimp Forms by MailMunch), affecting versions up to 3.2.2. The vulnerability is described as Stored XSS via Shortcode. Wordfence and related feeds note that the issue has been patched; specific fixed vers...