1679 matches found
CVE-2024-2299 Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui
A stored Cross-Site Scripting XSS vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is...
Google Android Information Disclosure Vulnerability (CNVD-2024-27516)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
PT-2024-18779 · Samsung · Samsung Internet
Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 25.0.0.41 Description: The issue is related to improper privilege management, allowing local attackers to bypass protection for cookies. This enables them to access sensitive information without proper...
CVE-2024-31966
The CVE-2024-31966 issue affects Mitel 6800 Series and 6900 Series SIP Phones (through 6.3 SP3 HF4), Mitel 6900w Series SIP Phone (through 6.3.3), and Mitel 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient parameter sanitization, allowing an authenticated attacker with adm...
Mitel 6800 SIP 和 6900 SIP 安全漏洞
Mitel 6800 SIP and Mitel 6900 SIP are both products of Mitel Canada.Mitel 6800 SIP is a 6800 SIP series IP phone.Mitel 6900 SIP is a 6900 SIP series IP phone. A security vulnerability exists in the Mitel 6800 SIP and 6900 SIP that stems from insufficient boundary checking, and successful...
CVE-2024-31965
A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct a path traversal attack due to insufficient input...
CVE-2024-33271
An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the pscustomer component...
PT-2024-25210 · Jizhicms · Jizhicms
Name of the Vulnerable Software and Affected Versions: jizhicms version 2.5.4 Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via a crafted article publication request. Recommendations: For jizhicms version 2.5.4, at the moment, there is no...
CVE-2024-33350
Directory Traversal vulnerability in TaoCMS v.3.0.2 allows a remote attacker to execute arbitrary code and obtain sensitive information via the include/model/file.php component...
SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co. Ltd (CNVD-2024-24538)
T+ is a new Internet-based business management software. Ltd. A SQL injection vulnerability exists in Changjitong T+, which can be exploited by attackers to obtain sensitive information from the database...
CVE-2024-1132 Keycloak: path transversal in redirection validation
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...
Weak Password Vulnerability in RG-ISG of Ruijie Networks Co.
Ruijie Networks Corporation is an industry-leading provider of network infrastructure and solutions. A weak password vulnerability exists in the RG-ISG of Ruijie Networks Corporation, which can be exploited by attackers to obtain sensitive information...
Advisory ROSA-SA-2024-2398
software: git 2.41.0 WASP: ROSA-CHROME packageevrstring: git-2.41.0-2.src.rpm CVE-ID: CVE-2022-23521 BDU-ID: 2023-00499 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the attribute definition mechanism for the gitattributes paths of the Git distributed version control system is related to...
PT-2024-14915 · WordPress · Inline Related Posts
Name of the Vulnerable Software and Affected Versions: Inline Related Posts WordPress plugin versions prior to 3.6.0 Description: The issue is related to missing authorization in an AJAX action, which allows any authenticated user, such as a subscriber, to retrieve the content of password-protect...
CVE-2024-30713
CVE-2024-30713 entry is rejected/not used and does not represent an active vulnerability.
CVE-2024-30719
CVE-2024-30719 is rejected; this candidate is not used and does not reflect an active vulnerability entry.
CVE-2024-3545
CVE-2024-3545 involves Devolutions Remote Desktop Manager (Windows) version 2024.1.20 and earlier, and Devolutions Server version 2024.1.8 and earlier. The vulnerability stems from improper permission handling in the vault offline cache feature, which could allow an attacker with access to the in...
CVE-2024-3545
Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a compute...
