CVE-2024-54341

CVE-2024-54341 affects LabelGrid Tools (LabelGrid Tools plugin) up to version 1.3.58, with an Improper Neutralization of Input During Web Page Generation leading to Reflected XSS. Connected sources confirm the issue and indicate a patched state; exploitation details are not provided in the suppli...

CVE-2024-54322

CVE-2024-54322 is a Reflected XSS in the Media Downloader plugin for WordPress (versions up to 0.4.7.4). The connected Wordfence record explicitly maps CVE-2024-54322 to Media Downloader

CVE-2024-54315 WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NicheAddons Events Addon for Elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through 2.2.2...

CVE-2024-54295

CVE-2024-54295 affects ListApp Mobile Manager. The issue is Missing Authorization to Privilege Escalation leading to Authentication Bypass (CVE-2024-54295). CVSS 3.1 base score 9.8 (CRITICAL); attack vector NETWORK, no user interaction required, impact to confidentiality, integrity, and availabil...

CVE-2024-54261

CVE-2024-54261 is a SQL Injection vulnerability affecting the WordPress plugin TAX SERVICE Electronic HDM (HK Digital Agency LLC) with affected versions from n/a up to 1.1.2. Public sources indicate a patched version release to address this issue (e.g., WordPress CVE entry and Patchstack referenc...

CVE-2024-54243

CVE-2024-54243 concerns the WordPress Echoza plugin where improper input neutralization during web page generation leads to a stored XSS (Echoza &lt;= 0.1.1). The vulnerability affects Echoza versions up to 0.1.1 and is documented across multiple feeds as Cross-Site Scripting with Stored XSS impa...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-49954)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49954 advisory. - In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in...

CVE-2024-47541

A flaw was found in the GStreamer library. An out-of-bounds write in the SSA subtitle parser can cause crashes for certain input files, potentially allowing a malicious third party to trigger an application crash...

PT-2024-17642 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A problem has been found in the system, affecting some unknown functionality of the file /control/client data.php. The manipulation of the id argument leads...

CVE-2024-47603 GHSL-2024-251: GStreamer NULL-pointer dereference in Matroska/WebM demuxer

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gstmatroskademuxupdatetracks function within matroska-demux.c. The vulnerability occurs when the gstcapsisequal function is called with invalid caps...

CVE-2024-47600 GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the formatchannelmask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the...

CVE-2024-47600 GHSL-2024-248: GStreamer has an OOB-read in format_channel_mask

GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the formatchannelmask function in gst-discoverer.c. The vulnerability affects the local array position, which is defined with a fixed size of 64 elements. However, the...

CVE-2024-47537 GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c

GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream-samples to accommodate stream-nsamples + samplescount elements of type QtDemuxSample. The problem is that samplescount is read from the input file. And i...

PT-2024-17617 · Unknown · Codezips Technical Discussion Forum

Name of the Vulnerable Software and Affected Versions: Codezips Technical Discussion Forum version 1.0 Description: A critical vulnerability was found in the unknown code of the file /signuppost.php. The manipulation of the Username argument leads to a SQL injection. The attack can be initiated...

CVE-2024-43751 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...

CVE-2024-54215

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through = 1.18...

CVE-2024-48866 QTS, QuTS hero

An improper handling of URL encoding Hex Encoding vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state. We have already fixed the vulnerability in the following...

CVE-2024-50388

CVE-2024-50388 is an OS command injection vulnerability affecting HBS 3 Hybrid Backup Sync. The vulnerability could allow remote code execution; affected versions include prior to 25.1.1.673, with fixes in 25.1.1.673 and later. Public disclosures in multiple feeds corroborate remote-command execu...

CVE-2024-53801

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through = 5.2.1...

PT-2024-23202 · Hcl +1 · Hcl Nomad Server On Domino +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The HTTP host header can be manipulated, causing the application to behave in unexpected ways. Any changes made to the header would cause the request to...