231585 matches found
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in swadeshswain Before After Image Slider WP allows Stored XSS.This issue affects Before After Image Slider WP: from n/a through 2.2...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Prasidhda Malla Honeypot for WP Comment allows Reflected XSS.This issue affects Honeypot for WP Comment: from n/a through 2.2.3...
Cross site scripting
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arunas Liuiza Content Cards allows Stored XSS.This issue affects Content Cards: from n/a through 0.9.7...
CVE-2024-24889
CVE-2024-24889 affects the WordPress plugin All 404 Pages Redirect to Homepage (version
CVE-2024-24931
CVE-2024-24931 concerns the Before After Image Slider WP plugin (versions through 2.2) with a Stored XSS due to improper neutralization of input during web page generation. Multiple sources (Wordfence, Red Hat advisory, CVE listing, PATCHSTACK) reiterate the same: vulnerable plugin/version, Store...
CVE-2024-24933
CVE-2024-24933 refers to a reflected Cross‑Site Scripting (XSS) vulnerability in the Honeypot for WP Comment plugin for WordPress (versions up to 2.2.3). The flaw allows unauthenticated attackers to inject scripts via the page parameter and is currently marked as Unpatched (no fix available in th...
Code injection
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is related to arch/x86/coco/tdx/tdx.c and arch/x86/mm/memencryptamd.c...
Design/Logic Flaw
createemptylvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi-lebsize...
Memory corruption
A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBIIOCATT, because kobj-name is not released...
Design/Logic Flaw
dmtablecreate in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to in alloctargets allocate more than INTMAX bytes, and crash, because of a missing check for struct dmioctl.targetcount...
CVE-2023-52430
The CVE-2023-52430 entry concerns the caddy-security plugin for Caddy (version 1.1.20). A reflected Cross-Site Scripting (XSS) vulnerability exists in GET requests where the URL payload begins with /admin or /settings/mfa/delete/. Root cause: insufficient input sanitization in handling those endp...
CVE-2024-25741
The CVE-2024-25741 issue affects the Linux kernel component printer_write in drivers/usb/gadget/function/f_printer.c (up to kernel 6.7.4). It states that usb_ep_queue is not called properly, which may allow a local attacker to cause a denial of service or other unspecified impact. The connected O...
CVE-2024-23763
CVE-2024-23763 affects Gambio up to version 4.9.2.0. A SQL Injection flaw exists where an attacker can craft a GET request using modifiers[attribute][] to execute arbitrary SQL commands. Impact per sources: potential data extraction/modification with high severity (CVSS v3.1 base score 9.8). Expl...
CVE-2024-25744
In CVE-2024-25744, Linux kernel versions before 6.6.7 are vulnerable: an untrusted VMM can trigger int80 syscall handling at any point due to code in arch/x86/coco/tdx/tdx.c and arch/x86/mm/mem_encrypt_amd.c. This is a local-privilege impact condition as described by the advisory, with a base sco...
CVE-2024-23760
CVE-2024-23760 affects Gambio 4.9.2.0 (and earlier) with cleartext storage of sensitive information in error handling logs (error-handler.log.json and legacy-error-handler.log.txt under the webroot). Root cause is information disclosure via log files exposed in the webroot. Documented impact is i...
CVE-2024-25360
CVE-2024-25360 concerns Motorola CX2L Router firmware v1.0.1. A hidden interface in the device exposes information related to the SystemWizardStatus component when a crafted request is sent to the device_web_ip. The vulnerability is described across multiple sources as an information disclosure f...
CVE-2024-23761
CVE-2024-23761 affects Gambio, specifically version 4.9.2.0 (and prior per CNNVD/CNNVD-like sources), where a Server Side Template Injection via a crafted smarty email template allows an attacker to execute arbitrary code. The issue is described consistently across Red Hat, NVD, CVE listings, and...
CVE-2024-25739
CVE-2024-25739 affects Linux kernel up to 6.7.4, where create_empty_lvol in drivers/mtd/ubi/vtbl.c may allocate zero bytes due to a missing check for ubi->leb_size, causing a crash (local, to crash an attacker-controlled workload). The issue is mapped to the ubi/VTBL path in the kernel; a fix ...
CVE-2024-23762
CVE-2024-23762 affects Gambio 4.9.2.0 Content Manager: Unrestricted File Upload allows uploading a crafted PHP file to execute arbitrary code. CVSSv3.1 base score 7.8 (HIGH); attack vector: LOCAL, attack complexity: LOW, privileges required: LOW, user interaction: NONE, impact on confidentiality,...