CVE-2024-46333

An authenticated cross-site scripting XSS vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function...

PT-2024-31994

Name of the Vulnerable Software and Affected Versions iq3xcite versions 2.31 through 3.05 Description A cross-site scripting XSS issue in the "/test/" component allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For versions 2.31 through 3.05, conside...

CVE-2024-45836

Cross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS network cameras. If a logged-in user accesses a specific file, an arbitrary script may be executed on the web browser of the user...

CVE-2024-45836: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS network cameras. If a logged-in user accesses a specific file, an arbitrary script may be executed on the web browser of the user...

httpd: Security issues via backend applications whose response headers are malicious or exploitable

A flaw was found in httpd. Backend applications whose response headers are malicious or exploitable may allow information disclosure, server-side request forgery SSRF or local script execution...

PT-2024-31801 · Planex Communications · Planex Communications Network Cameras

Name of the Vulnerable Software and Affected Versions: PLANEX COMMUNICATIONS network cameras affected versions not specified Description: A cross-site scripting issue exists in the web management page of the network cameras. If a logged-in user accesses a specific file, an arbitrary script may be...

Ellevo security vulnerabilities

Ellevo is an enterprise process-oriented software from Ellevo. A cross-site scripting vulnerability exists in Ellevo version 6.2.0.38160, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary Web...

Multiple vulnerabilities in PLANEX COMMUNICATIONS network devices

Overview Multiple network devices network cameras and a router provided by PLANEX COMMUNICATIONS INC. contain multiple vulnerabilities listed below. Cross-site request forgery CWE-352 - CVE-2024-45372 Cross-site scripting vulnerability in the web management page CWE-79 - CVE-2024-45836...

JVN#81966868: Multiple vulnerabilities in PLANEX COMMUNICATIONS network devices

Multiple network devices network cameras and a router provided by PLANEX COMMUNICATIONS INC. contain multiple vulnerabilities listed below. Cross-site request forgery CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L Base Score 7.1 CVE-2024-45372 Cross-site scripting vulnerability in the web...

CVE-2024-46639

A cross-site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box...

CVE-2024-45793

Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are subject to a cross site scripting vulnerability: GET /v1/credentials, GET /v1/credentials/, GET /v1/archive/credentials/, GET /v1/archive/credentials, POST...

Dassault Systèmes 3DEXPERIENCE security vulnerabilities

Dassault Systèmes 3DEXPERIENCE is a business and innovation platform from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes 3DEXPERIENCE. An attacker could exploit the vulnerability to execute arbitrary script code within a user's browser session...

Dassault Systèmes 3DEXPERIENCE security vulnerabilities

Dassault Systèmes 3DEXPERIENCE is a business and innovation platform from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes 3DEXPERIENCE, which originated. An attacker could exploit the vulnerability to execute arbitrary script code within a user's browser session...

CVE-2024-7737: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session...

WordPress plugin Welcart e-Commerce has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2024-45366: Improper Neutralization of Input During Web Page Generation

Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser...

CVE-2023-3410

The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder...

Red Hat Ansible log information leakage vulnerability

Red Hat Ansible is a computer system configuration manager from Red Hat USA. The product can be used to distribute, manage, and orchestrate computer systems. Red Hat Ansible suffers from a log information disclosure vulnerability that originates when sensitive information stored in an Ansible Vau...

CVE-2024-31414: Improper Neutralization of Input During Web Page Generation

The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts wh...

PT-2024-10991

Name of the Vulnerable Software and Affected Versions OpenText eDirectory version 9.2.5.0000 Description A Possible Cross-Site Scripting XSS issue has been discovered in the eDirectory component. This issue may allow for malicious script execution. Recommendations For OpenText eDirectory version...