CVE-2024-23516

CVE-2024-23516 affects the CC BMI Calculator WordPress plugin (vulnerable

CVE-2024-23517

CVE-2024-23517 describes a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Scheduling Plugin – Online Booking for WordPress (calendar-booking) affecting versions up to 3.5.10 (n/a–3.5.10). The issue stems from improper neutralization of input during web page generation , a...

CVE-2024-24712

The CVE-2024-24712 entry concerns the WordPress plugin Heateor Social Login (Heateor Social Login WordPress) with a Stored XSS issue caused by improper neutralization of input during web page generation. Affected versions are up to 1.1.30; a fixed release is 1.1.31. Public sources (Patchstack, Re...

CVE-2024-24713

CVE-2024-24713 concerns the WordPress plugin “Auto Listings – Car Listings & Car Dealership” vulnerable to a stored XSS due to improper input neutralization during web page generation. Affected versions are listed as n/a through 2.6.5. The issue is described as Cross-Site Scripting and was public...

CVE-2024-24801

CVE-2024-24801 is a Cross-Site Scripting (Stored XSS) vulnerability in the WordPress Owl Carousel Slider (OWL Carousel) plugin by LogicHunt, affecting version ranges up to 1.4.0. The root cause involves improper neutralization of user input during web page generation. Impact is stored XSS within ...

CVE-2024-0594

CVE-2024-0594 affects the WordPress plugin Awesome Support (WPAS) for WordPress. The vulnerability is a union-based SQL Injection in the wpas_get_users action, exploitable via the q parameter due to insufficient escaping and poor query preparation. Authenticated attackers with subscriber-level ac...

CVE-2024-1405

CVE-2024-1405 affects Linksys WRT54GL 4.30.18 Web Management Interface (file /wlaninfo.htm). Described as information-disclosure via an unknown feature/file. Publicly disclosed exploit exists. No patch details are provided in the supplied sources; some documents advise restricting access to /wlan...

Input validation

This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of servic...

Code injection

Sametime is impacted by lack of clickjacking protection in Outlook add-in. The application is not implementing appropriate protections in order to protect users from clickjacking attacks...

CVE-2023-45698

CVE-2023-45698 affects the HCL Sametime Outlook add-in, with lack of clickjacking protections as the root cause. The CVSSv3.1 base score is 6.1 (Medium); attack vector: Network; user interaction required; confidentiality/integrity impact low, availability none. Connected sources confirm the issue...

Design/Logic Flaw

Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser...

CVE-2023-28077

Dell BSAFE SSL-J contains an information-disclosure issue where debug messages reveal unnecessary information to a locally privileged user. Affected products are Dell BSAFE SSL-J versions before 6.5 and versions 7.0 and 7.1. The vulnerability stems from debug output that can expose sensitive data...

CVE-2023-45696

CVE-2023-45696 affects HCL Sametime, specifically issues in the Legacy web chat client where autocomplete is enabled for sensitive input fields. The underlying consequence is that user-entered data can be stored by the browser by default. Current documents provide the vulnerability description an...

Design/Logic Flaw

A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the publ...

CVE-2024-23323

Envoy CVE-2024-23323 affects the Envoy proxy where the regex matcher is compiled per request, causing high CPU and increased latency when multiple routes use such matchers. The issue has specific fixes in released versions 1.29.1, 1.28.1, 1.27.3, and 1.26.7; upgrading is advised. The provided doc...

CVE-2024-23324

Envoy CVE-2024-23324: External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to ext_authz, bypassing ext_authz checks when failure_mode_allow is true. Affects Envoy’s ext_authz handling; impact is limited to bypass of authorization fo...

CVE-2024-23325

CVE-2024-23325 concerns Envoy, a high‑performance proxy. The issue causes a crash in the Proxy protocol when an address type unsupported by the OS is observed; specifically, IPv6‑presented clients on hosts with IPv6 disabled and a listener with proxy protocol enabled can trigger a crash. The advi...

CVE-2024-23327

CVE-2024-23327 affects Envoy: when PPv2 is enabled on a listener and a downstream cluster, the Envoy process can segfault while crafting the upstream PPv2 header if the downstream request uses a LOCAL command type and lacks a protocol block. This vulnerability is fixed in Envoy releases 1.29.1, 1...

CVE-2024-1404

CVE-2024-1404 affects Linksys WRT54GL Web Management Interface (SysInfo.htm). The issue is an information disclosure due to manipulation of an unknown functionality in SysInfo.htm. Descriptions across sources confirm the vulnerability in firmware 4.30.18 and that the exploit has been disclosed pu...

CVE-2024-25109

Summary: CVE-2024-25109 affects the ManageWiki MediaWiki extension. The issue is an inadequate escape of interface messages on the form descriptor’s columns and help keys, enabling a potential cross-site scripting (XSS) attack. An attacker must have the (editinterface) right to exploit it. Impact...