CVE-2024-33819: Improper Neutralization of Input During Web Page Generation

Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...

PT-2024-25754 · Unknown · Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: Computer Laboratory Management System version 1.0 Description: The issue concerns a Cross Site Scripting vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters in th...

PT-2024-5188

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.27 Description: Cacti provides an operational monitoring and fault management framework. The issue arises from the automation tree rules form save function in automation tree rules.php, where some data is not...

PT-2024-5189

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.27 Description: Cacti provides an operational monitoring and fault management framework. The issue arises from the form save function in data queries.php, where some stored data is not thoroughly checked and is use...

Rukovoditel Customer Relationship Management XSS

The vulnerability of the index.php?module=users/registration&action=save component of the Customer Relationship Management system’s administration interface lies in the lack of protection for the website structure when processing the userphoto parameter. Exploiting this vulnerability allows an...

CVE-2024-33819

Globitel KSA SpeechLog version v8.1 is affected by a stored cross-site scripting (XSS) vulnerability within the Save Query function. This flaw allows for the execution of malicious scripts when the function is used. As a mitigation, it is recommended to disable the Save Query function until a for...

CVE-2024-33819

Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Save Query function...

PT-2024-25499 · Globitel · Globitel Ksa Speechlog

Name of the Vulnerable Software and Affected Versions: Globitel KSA SpeechLog version 8.1 Description: A stored cross-site scripting XSS issue was found in the Save Query function. Recommendations: For version 8.1, consider disabling the Save Query function until a patch is available to prevent...

PT-2024-14852

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin by Pdfcrowd WordPress plugin versions prior to 3.2.0 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability ...

PT-2024-18229

Name of the Vulnerable Software and Affected Versions SP Project & Document Manager plugin for WordPress versions up to, and including, 4.70 Description The issue allows authenticated attackers with subscriber-level access and above to update arbitrary folder names that do not belong to them due ...

CVE-2024-25522

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the officemissiveid parameter at /WorkFlow/wfworkformsave.aspx...

RuvarOA security vulnerabilities

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by the lack of validation of the officemissiveid parameter in the /WorkFlow/wfworkformsave.aspx file against external SQL input. An attacker can exploit this...

CVE-2024-34469

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

CVE-2024-34469

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

CVE-2023-50231

NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploi...

SUSE CVE-2024-26989

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsuspsave On arm64 machines, swsuspsave faults if it attempts to access MEMBLOCKNOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off...

CVE-2024-3287 SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization

The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the savesettings function in all versions up to, and including, 3.10.2. This makes it possible for unauthenticate...

PT-2024-29115 · WordPress · Cm Tooltip Glossary – Powerful Glossary Plugin

Name of the Vulnerable Software and Affected Versions: CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress versions up to, and including, 4.2.11 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving settings. This...

PT-2024-20306 · WordPress · User Registration – Custom Registration Form

Name of the Vulnerable Software and Affected Versions: User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin versions up to, and including, 3.1.5 Description: The issue is related to a missing capability check on the form save action function, allowing...

PT-2024-24925 · WordPress · Smartcrawl

Name of the Vulnerable Software and Affected Versions: SmartCrawl WordPress SEO checker plugin versions up to, and including, 3.10.2 Description: The issue is related to unauthorized ld+json description injection due to a missing capability check on the save settings function. This allows...