CVE-2024-10336

CVE-2024-10336 affects SourceCodeHero Clothes Recommendation System 1.0. The vulnerability is a SQL injection in the Admin Login Page, specifically via the t1 parameter in the file /admin/index.php. Root cause: improper handling of user input leading to injection of SQL statements. Impact, as sta...

CVE-2024-10336 SourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injection

A vulnerability was found in SourceCodeHero Clothes Recommendation System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/index.php of the component Admin Login Page. The manipulation of the argument t1 leads to sql injection. The attack may be...

CVE-2024-45031 Apache Syncope: Stored XSS in Console and Enduser

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...

PT-2024-31384

Name of the Vulnerable Software and Affected Versions: Syncope versions prior to 3.0.9 Description: The issue allows an attacker to bypass HTML sanitization by using incomplete HTML tags when editing objects in the Syncope Console. This enables the injection of stored XSS payloads, which can...

PT-2025-17573

Name of the Vulnerable Software and Affected Versions Jmix versions 1.0.0 through 1.6.1 Jmix versions 2.0.0 through 2.3.4 Description The issue affects Jmix, a set of libraries and tools for Spring Boot data-centric application development. It allows manipulation of the input parameter, which...

SourceCodeHero Clothes Recommendation System SQL注入漏洞

SourceCodeHero Clothes Recommendation System is a SourceCodeHero open source clothing recommendation system. A SQL injection vulnerability exists in SourceCodeHero Clothes Recommendation System version 1.0, which stems from the parameter view/view1 in the file /admin/home.php that can lead to SQL...

SourceCodeHero Clothes Recommendation System SQL注入漏洞

SourceCodeHero Clothes Recommendation System is a SourceCodeHero open source clothing recommendation system. SourceCodeHero Clothes Recommendation System version 1.0 suffers from a SQL injection vulnerability, which originates from the parameter t1 in the file /admin/index.php of the component...

Prototype Pollution json5 Dependency in Confluence Data Center

This High severity json5 Dependency vulnerability was introduced in versions 5.9 of Confluence Data Center. This json5 Dependency vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to...

PT-2024-7217

Name of the Vulnerable Software and Affected Versions FortiManager versions 6.2.0 through 6.2.12 FortiManager versions 6.4.0 through 6.4.14 FortiManager versions 7.0.0 through 7.0.12 FortiManager versions 7.2.0 through 7.2.7 FortiManager versions 7.4.0 through 7.4.4 FortiManager version 7.6.0...

PT-2024-9377

Name of the Vulnerable Software and Affected Versions: CyberPanel versions through 2.3.6 and unpatched 2.3.7 Description: The issue is related to the upgrademysqlstatus function in CyberPanel, which has inadequate authentication procedures. This allows a remote attacker to bypass authentication a...

PT-2024-8882 · Cleantalk · Cleantalk

Name of the Vulnerable Software and Affected Versions: CleanTalk versions up to and including 6.43.2 Description: The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is susceptible to unauthorized Arbitrary Plugin Installation due to an authorization bypass. This bypass is...

PT-2024-7551 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.92 Description: The issue is related to an out of bounds write in the Dawn component of Google Chrome, which can be exploited by a remote attacker to perform out of bounds memory access via a crafted...

[SECURITY] [DLA 3934-1] libheif security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3934-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 22, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3930-1] libsepol security update

Debian LTS Advisory DLA-3930-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 22, 2024 https://wiki.debian.org/LTS Package : libsepol Version : 3.1-1+deb11u1 CVE ID : CVE-2021-36084 CVE-2021-36085 CVE-2021-36086 CVE-2021-36087 Debian Bug : 990526 Multiple...

[SECURITY] [DSA 5795-1] python-sql security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5795-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 21, 2024 https://www.debian.org/security/faq -...

PT-2024-33042 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 5.0.2 Description: The issue is related to SQL Injection via the selectFields parameter in the index method of the Auth.php file. This allows for potential exploitation. Recommendations: For Funadmin version 5.0.2, consider...

PT-2024-33856

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue is related to an integer overflow in the Linux kernel's DRM/AMD display module. Specifically, the sampling rate variable, which is an uint8 t, is assigned an unsigned int, leading t...

PT-2024-33444 · Wpfactory · Wpfactory Email Verification For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Email Verification for WooCommerce versions n/a through 2.8.10 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows...

PT-2024-33386 · Unknown · Ad Inserter

Name of the Vulnerable Software and Affected Versions: Ad Inserter versions n/a through 2.7.37 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions n/a...

PT-2024-28233

Name of the Vulnerable Software and Affected Versions VMware Spring versions prior to 6.1.13 Description The issue concerns improper access controls via DataBinder and String.toLowerCase, which has locale-dependent exceptions. This could result in fields not being protected as expected, potential...