PT-2024-8002 · Lb Link · Lb-Link Bl-Wr 1300H

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-WR 1300H version 1.0.4 Description: The issue is related to hardcoded credentials stored in the /etc/shadow file of the LB-LINK BL-WR 1300H router. These credentials are easily guessable, which could allow a remote attacker to gain...

AZL-51904 CVE-2024-49761 affecting package ruby for versions less than 3.3.5-1

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between & and x...; in a hex numeric character reference &x...;. This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML...

GHSA-2RXP-V6PW-CH6M REXML ReDoS vulnerability

Impact The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between & and x...; in a hex numeric character reference &x...;. This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on...

PT-2024-16263 · Unknown · Code-Projects Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management System version 1.0 Description: A problematic issue was found in the system, affecting some unknown functionality of the file /bloodrequest.php. The manipulation of the msg argument leads to cross-site...

CVE-2020-26303

The CVE-2020-26303 entry concerns the insane HTML sanitizer. Affected versions are 2.6.2 and earlier. The underlying issue is a Regular Expression Denial of Service (ReDoS) vulnerability in one or more regular expressions used by the sanitizer. Public documentation indicates that as of publicatio...

CVE-2022-25255 affecting package qt5-qtbase for versions less than 5.12.11-14

CVE-2022-25255 affecting package qt5-qtbase for versions less than 5.12.11-14. A patched version of the package is available...

WordPress Astra Widgets Plugin <= 1.2.14 is vulnerable to Cross Site Scripting (XSS)

Software Astra Widgets Type Plugin Vulnerable versions = 1.2.14 Fixed in 1.2.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50439 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID aae8162e86d9 Credits João Pedro S Alcântara Kinorth Require...

PT-2024-16163 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A problematic issue was found in ZZCMS, affecting an unknown part of the file 3/qq-connect2.0/API/com/inc.php, leading to information disclosure. The attack can be initiated remotely. Recommendations: For ZZCMS...

PT-2024-33171 · Sage · Sage 1000

Name of the Vulnerable Software and Affected Versions: Sage 1000 version 7.0.0 Description: A Reflected Cross-Site Scripting issue exists, allowing attackers to inject malicious scripts into URLs. These scripts are reflected back by the server in the response without proper sanitization or...

PT-2024-16112 · Code Projects · Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A problem was discovered in the Pharmacy Management System, affecting some unknown functionality of the file /manage medicine.php of the component Manage Medicines Page. The...

PT-2024-33351 · Sangoma · Asterisk +1

Name of the Vulnerable Software and Affected Versions: Sangoma Asterisk versions 18.20.0 and earlier, 19.x, 20.x through 20.5.0, and 21.x through 21.0.0 Certified Asterisk through 18.9-cert5 Description: A path traversal vulnerability was discovered due to the functions action getconfig and actio...

PT-2024-7364 · Unknown · Laquis Scada

Name of the Vulnerable Software and Affected Versions: LAquis SCADA version 4.7.1.511 Description: A cross-site scripting vulnerability in LAquis SCADA could allow an attacker to inject arbitrary code into a web page, potentially enabling them to steal cookies, redirect users, or perform...

CVE-2024-6345 affecting package python-setuptools for versions less than 69.0.3-4

CVE-2024-6345 affecting package python-setuptools for versions less than 69.0.3-4. A patched version of the package is available...

CVE-2024-44990 affecting package kernel for versions less than 6.6.51.1-1

CVE-2024-44990 affecting package kernel for versions less than 6.6.51.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-42228 affecting package kernel for versions less than 5.15.167.1-1

CVE-2024-42228 affecting package kernel for versions less than 5.15.167.1-1. A patched version of the package is available...

CVE-2024-44946 affecting package kernel for versions less than 5.15.167.1-1

CVE-2024-44946 affecting package kernel for versions less than 5.15.167.1-1. A patched version of the package is available...

Vulnerabilities fixed in Draytek Vigor routers

Draytek has fixed vulnerabilities in several types of Vigor series routers. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, or perform a Cross-Site-Scripting attack, potentially gaining access to sensitive data or executing arbitrary code in the context of the...

GHSA-QVQV-MCXR-X8QW Slim Select has potential Cross-site Scripting issue

Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption, the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate...

PT-2024-39616

Name of the Vulnerable Software and Affected Versions OFCMS version 1.1.2 Description A problematic vulnerability has been found in OFCMS, affecting the add function of the file "/admin/system/dict/add.json?sqlid=system.dict.save". The manipulation of the dict value argument leads to cross-site...

PT-2024-31848 · Solvait · Solvait

Name of the Vulnerable Software and Affected Versions: Solvait version 24.4.2 Description: A Stored Cross-Site Scripting XSS vulnerability allows remote attackers to inject malicious scripts into the application due to insufficient input validation and sanitization in the "Intrest" feature...