16956 matches found
CVE-2024-29400
An issue was discovered in RuoYi v4.5.1, allows attackers to obtain sensitive information via the status parameter...
CVE-2024-29461
An issue in Floodlight SDN OpenFlow Controller v.1.2 allows a remote attacker to cause a denial of service via the datapath id component...
PopojiCMS Version 2.0.1 - Remote Command Execution
Exploit Title: PopojiCMS Version : 2.0.1 Remote Command Execution Date: 27/11/2023 Exploit Author: tmrswrr Vendor Homepage: https://www.popojicms.org/ Software Link: https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip Version: Version : 2.0.1 Tested on:...
PT-2024-22881 · Ruoyi · Ruoyi
Name of the Vulnerable Software and Affected Versions: RuoYi version 4.5.1 Description: An issue was discovered that allows attackers to obtain sensitive information via the status parameter. Recommendations: For RuoYi version 4.5.1, consider restricting access to the status parameter to minimize...
BELL-CVE-2024-26256
Bulletin has no description...
BELL-CVE-2024-3567
Bulletin has no description...
GHSA-MV5W-WR5C-575P WWBN AVideo Remote Code Execution
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component...
Integer Overflow
FreeRDP is vulnerable to an Integer Overflow in freerdpbitmapplanarcontextreset, leading to a heap-buffer overflow. The vulnerability is due to a malicious server preparing a RDPGFXRESETGRAPHICSPDU to allocate too small buffers, potentially triggering later out-of-bounds read/write...
CVE-2024-31987 XWiki Platform remote code execution from account via custom skins support
XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote...
CVE-2024-3515
Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2021-47194
In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211stopap when switch from P2PGO type If the userspace tools switch from NL80211IFTYPEP2PGO to NL80211IFTYPEADHOC via sendmsgNL80211CMDSETINTERFACE, it does not call the cleanup cfg80211stopap, this leads to t...
GHSA-WVPX-G427-Q9WC llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WooCommerce UPS Shipping – Live Rates and Access Points versions = 2.2.4...
MAL-2024-1228 Malicious code in @lbnqduy11805/redesigned-journey (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19f2fc0c7ff93d8800786c36451ee9bba3a43f050f0f3b2628d305addac6112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-21507
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key...
PT-2024-21279 · Unknown · Ninja Forms
Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.8.1 Description: The issue is related to a cross-site scripting vulnerability in submit processing. If exploited, an arbitrary script may be executed on the web browser of the user accessing the website using t...
CVE-2024-23076
JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been...
CVE-2024-27476
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...