1110 matches found
PT-2024-35313 · Unknown · Html5 Lyrics Karaoke Player
Name of the Vulnerable Software and Affected Versions: HTML5 Lyrics Karaoke Player versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...
PT-2024-35288 · Unknown · Webcodingplace Ultimate Classified Listings
Name of the Vulnerable Software and Affected Versions: WebCodingPlace Ultimate Classified Listings versions 1.4 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allow...
WordPress plugin Amazon Associate Filter 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
WordPress HTML5 Lyrics Karaoke Player plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin HTML5 Lyrics Karaoke Player versions = 2.4...
WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by CTRL - Chance Patchstack Alliance in WordPress Plugin Convert Docx2post versions = 1.4...
PT-2024-32077 · Weechat +1 · Weechat +1
Name of the Vulnerable Software and Affected Versions: WeeChat versions prior to 4.4.2 Description: The issue is caused by an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects functions such as string free split...
CVE-2024-52007 XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...
PT-2024-27592 · Post Grid · Post Grid
Name of the Vulnerable Software and Affected Versions: Post Grid versions through 7.7.4 Description: The issue is related to a Missing Authorization vulnerability in Post Grid, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions through...
SiSMART 安全漏洞
SiSMART is a content management system from SiSMART, Inc. A security vulnerability exists in SiSMART version 7.4.0 that stems from the presence of an insecure direct object reference in the dashboard that allows an attacker to perform a horizontal-privilege upgrade...
PT-2024-33193
Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description A SQL injection issue exists in the /SASStudio/sasexec/sessions/sessionID/sql endpoint of SAS Studio, allowing a remote attacker to execute arbitrary SQL commands via the POST body request. This issue is...
Kerui HD 3MP 1080P Tuya Camera 安全漏洞
Kerui HD 3MP 1080P Tuya Camera is a high-definition surveillance camera from Kerui. A security vulnerability exists in Kerui HD 3MP 1080P Tuya Camera version 1.0.4, which stems from the presence of a command injection vulnerability that allows an attacker to create a customized, unauthenticated Q...
PT-2024-33194
Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description The issue concerns an unrestricted file upload in the /SASStudio/SASStudio/sasexec/sessionID/InternalPath endpoint, allowing a remote attacker to upload malicious files. This is disputed by the vendor as file...
WordPress Advanced Sermons plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Advanced Sermons versions = 3.4...
Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Unauthenticated Open Redirection vulnerability
Unauthenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...
PT-2024-39641 · WordPress · Embed Pdf Viewer
Name of the Vulnerable Software and Affected Versions: Embed PDF Viewer plugin for WordPress versions up to, and including, 2.4.4 Description: The issue is related to Stored Cross-Site Scripting via the height and width parameters due to insufficient input sanitization and output escaping. This...
WordPress plugin Starter Templates 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Bluetooth Core Specification 安全漏洞
The Bluetooth Core Specification is a specification for Bluetooth. It defines the technical building blocks used by developers to create the interoperable devices that make up the thriving Bluetooth ecosystem. Overseen by the Bluetooth Special Interest Group SIG and regularly updated and enhanced...
In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10 the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c) when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata leading to a denial of service or code execution attack. This occurs in gdk_pixbuf_set_option() in gdk-pixbuf.c.
...
eNMS 安全漏洞
eNMS is a network automation platform from eNMS Open Source. A security vulnerability exists in eNMS versions prior to 4.4.0 through 4.7.1, which stems from vulnerability to directory traversal attacks via editfile...
