CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-21574: Improper Control of Generation of Code

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

PT-2024-18965

Name of the Vulnerable Software and Affected Versions SoftwareX affected versions not specified Description The issue arises from a lack of validation of the pip field in a POST request sent to the "/customnode/install" endpoint, which is used to install custom nodes and is added to the server by...

CVE-2024-50585 Reflected Cross-Site Scripting

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

CVE-2024-50585 Reflected Cross-Site Scripting

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

Exploit for CVE-2024-12270

CVE-2024-12270 Beautiful Taxonomy Filters = 5.1 AND string err...

Tenda RX9 DoS

The vulnerability of the sub42EEE0 function in Tenda RX9 and RX9 Pro microprogrammed software routers is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to cause service failure by sending a specially crafted POST request...

Tenda RX9 Pro Sub_4337EC DoS

The vulnerability of the sub4337EC function in the Tenda RX9 Pro router’s microprogramming system is related to writing beyond buffer boundaries. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...

CVE-2024-12183

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2024-12183 DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2024-12183

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2024-12183 DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...

PT-2024-17475 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.116 Description: A problematic vulnerability was found in DedeCMS, affecting the RemoveXSS function of the file /plus/carbuyaction.php in the HTTP POST Request Handler component. This leads to cross-site scripting attacks,...

CVE-2024-12183: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2024-8748

The CVE-2024-8748 entry describes a buffer overflow in the packet parser of the third‑party library libclinkc used by Zyxel VMG8825‑T50K firmware up to V5.50(ABOM.8.4)C0. This can allow a remote attacker to cause a temporary DoS of the device web management interface by sending a crafted HTTP POS...

CVE-2024-8748

A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50ABOM.8.4C0 could allow an attacker to cause a temporary denial of service DoS condition against the web management interface by sending a crafted HTTP...

Zyxel VMG8825-T50K security vulnerabilities

The Zyxel VMG8825-T50K is an Internet access device from China Hopkins Zyxel. A security vulnerability exists in Zyxel VMG8825-T50K V5.50 ABOM.8.4 version C0 and prior versions. An attacker can exploit the vulnerability by sending a specially crafted HTTP POST request to cause the program to deny...