CVE-2024-6006

CVE-2024-6006 affects ZKTeco ZKBio CVSecurity V5000 4.1.0, specifically the Summer Schedule Handler’s Schedule Name argument. Exploitation allows cross-site scripting and may be triggered remotely; the exploit has been disclosed. The vendor notes ZKBio Security V5000 was withdrawn and recommends ...

CVE-2024-6006: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launch...

ZKTeco ZKBioSecurity Code Injection Vulnerability

ZKTeco ZKBioSecurity is a web-based all-in-one platform from the Chinese company ZKTeco. A code injection vulnerability exists in ZKTeco ZKBioSecurity version 4.1.0, which stems from an incorrect operation of the parameter Schedule Name that can lead to cross-site scripting...

CVE-2024-37641

TRENDnet TEW-814DAP v1FW1.01B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule...

PT-2024-27694 · Trendnet · Trendnet Tew-814Dap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-814DAP version 1 FW1.01B01 Description: A stack overflow issue was discovered, which can be triggered via the submit-url parameter at the "/formNewSchedule" API endpoint. Recommendations: For TRENDnet TEW-814DAP version 1...

CVE-2024-5851

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

CVE-2024-5851 playSMS SMS Schedule cross site scripting

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

CVE-2024-5851 playSMS SMS Schedule cross site scripting

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

PT-2024-32117

Name of the Vulnerable Software and Affected Versions Events Addon for Elementor plugin for WordPress versions up to, and including, 2.1.4 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Basic Slider, Upcoming Events, and...

CVE-2024-4669: Improper Neutralization of Input During Web Page Generation

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2024-5851: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability classified as problematic has been found in playSMS up to 1.4.7. Affected is an unknown function of the file /index.php?app=main&inc=featureschedule&op=list of the component SMS Schedule Handler. The manipulation of the argument name/message leads to basic cross site scripting. It...

PT-2024-37191

Name of the Vulnerable Software and Affected Versions: playSMS versions up to 1.4.7 Description: A problematic vulnerability has been found in the SMS Schedule Handler component. The issue affects an unknown function of the file /index.php?app=main&inc=feature schedule&op=list. The manipulation o...

Security and Human Behavior (SHB) 2024

This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of...

CVE-2024-34854

F-logic DataCube3 v1.0 is vulnerable to File Upload via /admin/transceiverschedule.php...

F-logic DataCube3 安全漏洞

F-logic DataCube3 is a small measurement terminal system from F-logic Japan. A security vulnerability exists in F-logic DataCube3 v1.0, which originates from a file upload vulnerability in the file /admin/transceiverschedule.php...

F-logic DataCube3 安全漏洞

F-logic DataCube3 is a small measurement terminal system from F-logic Japan. A security vulnerability exists in F-logic DataCube3 v1.0, which originates from a command injection vulnerability in the file /admin/transceiverschedule.php...

CVE-2024-31395

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

CVE-2024-31395

A stored cross-site scripting (XSS) vulnerability exists in the a-blog cms content management system. The flaw originates from the Schedule labeling pages and allows a user with editor or higher privileges to execute arbitrary scripts in the web browser of any user accessing that page. Affected v...

CVE-2024-31395: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

UBUNTU-CVE-2023-52738

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/fence: Fix oops due to non-matching drmsched init/fini Currently amdgpu calls drmschedfini from the fence driver sw fini routine - such function is expected to be called only after the respective init function -...