CVE-2024-1149

CVE-2024-1149 concerns Snow Software Inventory Agent across macOS, Windows, and Linux. It stems from improper verification of cryptographic signatures, allowing file manipulation via Snow Update Packages. Affected versions include Inventory Agent up to 6.12.0, 6.14.5, and 6.7.2. The root cause is...

CVE-2024-0985

Summary: CVE-2024-0985 describes a late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL that lets an object creator execute arbitrary SQL as the command issuer. The attack targets untrusted materialized views and can affect multiple PostgreSQL branches before fixed versions...

CVE-2023-7169

Summary (CVE-2023-7169): Affected product is Snow Software Snow Inventory Agent on Windows. The issue is an Authentication Bypass by Spoofing (signature spoof) that impacts versions up to 6.14.5; customers are advised to upgrade to version 7.0. The NVD vector shows a likely local, low-attack-vect...

Spoofing

Plaintext Storage of a Password vulnerability in Mia Technology Inc. MIA-MED allows Read Sensitive Strings Within an Executable.This issue affects MIA-MED: before 1.0.7...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lê Van To?n Woocommerce Vietnam Checkout allows Stored XSS.This issue affects Woocommerce Vietnam Checkout: from n/a through 2.0.7...

Design/Logic Flaw

Exposure of Data Element to Wrong Session vulnerability in Mia Technology Inc. MIA-MED allows Read Sensitive Strings Within an Executable.This issue affects MIA-MED: before 1.0.7...

CVE-2024-24880

CVE-2024-24880 affects the Apollo13 Framework Extensions WordPress plugin (versions

CVE-2024-24885

CVE-2024-24885 concerns the WordPress plugin WooCommerce Vietnam Checkout (versions ≤ 2.0.7). The issue is an improper neutralization of user input during web page generation, enabling a Stored Cross-Site Scripting (XSS) vulnerability. The Patchstack entry confirms a fix in version 2.0.8 and note...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Acowebs Product Labels For Woocommerce Sale Badges allows Stored XSS.This issue affects Product Labels For Woocommerce Sale Badges: from n/a through 1.5.3...

CVE-2024-24886

CVE-2024-24886 affects the WordPress plugin Product Labels For Woocommerce (Sale Badges). Connected sources confirm an authenticated Stored XSS via the badgeLabel parameter in versions up to 1.5.3. Patchstack lists the fix in version 1.5.4, with low CVSS v3.1 score around 5.9, and requires Shop M...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in Mia Technology Inc. MIA-MED allows Authentication Abuse.This issue affects MIA-MED: before 1.0.7...

CVE-2024-22464

Dell EMC AppSync (versions 4.2.0.0–4.6.0.0) contains a log-based information disclosure vulnerability in AppSync server logs. A high-privilege remote attacker could potentially access exposed credentials from logs, enabling unauthorized access with the compromised account’s privileges. Affected p...

Cross site request forgery (csrf)

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.51.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description: The httpparser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a...

CVE-2024-1207

CVE-2024-1207 affects WP Booking Calendar for WordPress (versions up to 9.9). The vulnerability is an unauthenticated SQL Injection via the calendar_request_params[dates_ddmmyy_csv] parameter, caused by insufficient escaping and inadequate query preparation. Public disclosures (NVD and Red Hat) r...

Remote code execution

Zentao v18.0 to v18.10 was discovered to contain a remote code execution RCE vulnerability via the checkConnection method of /app/zentao/module/repo/model.php...

CVE-2024-0511

CVE-2024-0511 — The Royal Elementor Addons and Templates WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to 1.3.87 due to missing/incorrect nonce validation on the wpr_update_form_action_meta function, enabling unauthenticated attackers to post metadata via ...

Design/Logic Flaw

An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 allows attackers to execute arbitrary code via uploading a crafted .txt file...

CVE-2023-5665

The Payment Forms for Paystack plugin for WordPress is affected by a Stored XSS in all versions up to 3.4.1 due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Exploitation requires attacker with contributor-level permissions to inject scripts, which ...

CVE-2024-25144

The CVE-2024-25144 issue affects Liferay Portal and Liferay DXP via the IFrame widget: when rendering iframes, the URL is not validated, enabling an authenticated remote user to trigger a denial-of-service (DoS) by self-referencing the IFrame. Affected versions include Portal 7.2.0–7.4.3.26 and L...