CVE-2024-4021 Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure

A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /ndmComponents.js of the component Configuration Setting Handler. The manipulation leads...

PT-2024-3258 · Keenetic · Keenetic Kn-1810 +4

Name of the Vulnerable Software and Affected Versions: Keenetic KN-1010, KN-1410, KN-1711, KN-1810, and KN-1910 versions up to 4.1.2.15 Description: A vulnerability was found in the file /ndmComponents.js of the component Configuration Setting Handler, which can lead to information disclosure. Th...

CVE-2024-4021: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /ndmComponents.js of the component Configuration Setting Handler. The manipulation leads...

Updated less packages fix security vulnerability

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the...

Denial Of Service (DOS)

Apache Traffic Server ATS is vulnerable to an HTTP/2 CONTINUATION DoS attack. The vulnerability is due to the attack causing ATS to consume more server resources, potentially leading to resource exhaustion. Users can mitigate this by setting a new setting...

PT-2024-23689 · Unknown · Pescms Team

Name of the Vulnerable Software and Affected Versions: PESCMS-TEAM version 2.3.6 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under the...

Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_optin_save

Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcoptinsave function. This makes it possible for unauthenticated attackers to update the optin...

CVE-2024-30952

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

CVE-2024-30952: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

Tenda FH1202 安全漏洞

Tenda FH1202 is a dual-band wireless router from Tenda that supports 2.4GHz and 5GHz bands with a total transmission rate of 1200Mbps. The Tenda FH1202 suffers from a buffer overflow vulnerability that originates from the adslPwd parameter of the formWanParameterSetting method failing to correctl...

CVE-2024-3877

A vulnerability classified as critical was found in Tenda F1202 1.2.0.20408. Affected by this vulnerability is the function fromqossetting of the file /goform/fromqossetting. The manipulation of the argument qos leads to stack-based buffer overflow. The attack can be launched remotely. The exploi...

HTMLy Version v2.9.6 - Stored XSS Vulnerability

Exploit Title: HTMLy Version v2.9.6 - Stored XSS Exploit Author: tmrswrr Vendor Homepage: https://www.htmly.com/ Version 3.10.8.21 Date : 04/08/2024 1 Login admin https://127.0.0.1/HTMLy/admin/config 2 General Setting Blog title " 3 After save it you will be see XSS alert...

CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting proxy.config.http2.maxcontinuationframesperminute to limit the number of CONTINUATION frames...

HTMLy 2.9.6 Cross Site Scripting

Exploit Title: HTMLy Version : 2.9.6 - Stored XSS Exploit Author: tmrswrr Vendor Homepage: https://www.htmly.com/ Version 3.10.8.21 Date : 04/08/2024 1 Login admin https://127.0.0.1/HTMLy/admin/config 2 General Setting Blog title " 3 After save it you will be see xss alert...

WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability

Unauthenticated Arbitrary WordPress Setting Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Bricksforge versions = 2.0.17...

CVE-2024-24506

Cross Site Scripting XSS vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function...

CVE-2024-24506

Cross Site Scripting XSS vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function...

CVE-2024-24506: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitrary code via the Administrator email address parameter in the General Setting function...

CVE-2024-24506

A Stored Cross-Site Scripting (XSS) vulnerability exists in LimeSurvey Community Edition Version v.5.3.32+220817 . The flaw is located in the General Setting function, specifically within the Administrator email address parameter. Because LimeSurvey fails to properly validate user-supplied input ...

CVE-2024-3142 Clavister E10/E80 Setting cross-site request forgery

A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed ...