123solar 安全漏洞

123Solar is a set of lightweight PHP/JS files from the individual developer Jean-Marc Louviaux. A security vulnerability exists in 123solar 1.8.4.5 and earlier versions, which stems from the parameter PROTOCOLx in the file /admin/admininvt2.php that can lead to a remote attack on the file...

Foxit PDF Reader PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PD...

USN-7032-1 tomcat8, tomcat9 vulnerability

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A remote attacker could possibly use this issue to perform HTTP request smuggling...

CVE-2024-9089

A vulnerability was found in SourceCodester Modern Loan Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file updateloanrecord.php. The manipulation of the argument amount leads to cross site scripting. The attack may be initiated remotely. Th...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions prior to Google Chrome 126.0.6478.54, which can be exploited by remote attackers to potentially perform a sandbox escape via a crafted HTML page...

PT-2024-39409 · Stirling Tools · Stirling-Pdf

Name of the Vulnerable Software and Affected Versions: Stirling-Tools Stirling-PDF versions up to 0.28.3 Description: A vulnerability was found in the Markdown-to-PDF component of Stirling-Tools Stirling-PDF, leading to cross-site scripting. The attack can be initiated remotely, with a rather hig...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) clients that are located remotely or in the cloud lies in improper code generation. This allows an attacker to execute arbitrary code.

The vulnerability of the backup and data recovery software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the LoadSlotsTable method in the Ivanti EPM endpoint management software allows a hacker to execute arbitrary code.

The vulnerability of the LoadSlotsTable method in the Ivanti EPM endpoint management software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Zimbra Collaboration Suite’s email management system, which stems from insufficient validation of incoming requests, allows attackers to carry out SRF attacks.

The vulnerability of the Zimbra Collaboration Suite’s email management system is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to carry out a SRF attack remotely...

CVE-2024-8876

A vulnerability, which was classified as problematic, has been found in xiaohe4966 TpMeCMS up to 1.3.3.1. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The...

The vulnerability of the Adobe Experience Manager content and media data management system lies in the insufficient protection of website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Adobe Experience Manager content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-8562

A vulnerability was found in SourceCodester PHP CRUD 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /endpoint/Add.php. The manipulation of the argument firstname/middlename/lastname leads to cross site scripting. The attack may be launched...

PT-2024-6451 · D Link · D-Link Dns-320

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320 version 2.02b01 Description: A problematic issue has been found in the Web Management Interface of the D-Link DNS-320, specifically in the file /cgi-bin/widget api.cgi. The manipulation of the getHD, getSer, or getSys argument...

CVE-2024-8380

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some unknown processing of the file /endpoint/delete-account.php of the component Delete Contact Handler. The manipulation of the argument contact leads to sql...

Exploit for CVE-2024-7954

Description The porteplume plugin used by SPIP before 4.30-...

SAP MaxDB Cons.exe Remote Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP MaxDB cons.exe Remote Command Injection', 'Description' = %q SAP MaxDB is prone to a remote command-injection vulnerability because the...

CVE-2024-8337

A vulnerability, which was classified as problematic, has been found in SourceCodester Contact Manager with Export to VCF 1.0. Affected by this issue is some unknown functionality of the file index.html. The manipulation of the argument contactname leads to cross site scripting. The attack may be...

(0Day) Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDATESExtractFile function. A crafted software update file...

(0Day) Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASHDDUFindFile function. A crafted software update file...

CVE-2024-8229

A vulnerability was found in Tenda O6 1.0.0.72054. It has been declared as critical. This vulnerability affects the function frommacFilterModify of the file /goform/operateMacFilter. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be initiated remotely. T...