CVE-2024-1177: Missing Authorization

The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settingssave function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to update th...

WordPress Review & Structure Data Schema Plugin – Review Schema < 2.2.0 - Missing Authorization to Arbitrary Review Update

Description The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrsreviewedit function in all versions up to, and including, 2.1.14. This makes it possible for...

PT-2024-2143 · Tp Link · Tp-Link Archer C50

Name of the Vulnerable Software and Affected Versions: TP-Link Archer AX50 version 1.0.11 build 2022052 Description: The issue is related to a Cross-Site Scripting XSS vulnerability that could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious...

The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of measures taken to protect the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows attackers to execute cross-site scripting XSS attacks remotely...

CVE-2024-23883

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxstructuremodify.php, in the description parameter. Exploitation of this...

CVE-2024-23876

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxstructurecreate.php, in the description parameter. Exploitation of this...

Cross site scripting

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxstructuremodify.php, in the description parameter. Exploitation of this...

CVE-2024-23883 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/taxstructuremodify.php, in the description parameter. Exploitation of this...

Cups Easy 跨站脚本漏洞

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from a failure to adequately escape the description parameter on the /cupseasylive/taxstructurelist.php page. An...

PT-2024-20126 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, where user-controlled inputs are not sufficiently encoded. This issue can be exploited via the /cupseasylive/taxstructurelinecreate.ph...

Cups Easy 跨站脚本漏洞

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the description parameter on the /cupseasylive/taxstructurecreate.php page. An attacker...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2024-1130)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file...

USN-6607-1 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities

It was discovered that the SMB network file sharing protocol implementation in the Linux kernel did not properly handle certain error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...

kernel: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: vcscreen: move load of struct vcdata pointer in vcsread to avoid UAF After a call to consoleunlock in vcsread the vcdata struct can be freed by vcdeallocate. Because of that, the struct vcdata pointer load must be done at the top...

CVE-2023-51042

A use-after-free flaw was found in the Linux kernel's AMD GPU driver which may allow access to members of a synchronization structure after the structure is freed. This issue could allow a local user to crash the system or to access confidential system memory. Mitigation To mitigate this issue,...

The vulnerability of the Citrix StoreFront application store exists due to the lack of measures taken to protect the website structure. This allows attackers to carry out XSS attacks.

The vulnerability of the Citrix StoreFront application exists because measures are not taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the software for managing and controlling access to corporate resources and IBM Security Verify Governance applications lies in the lack of protective measures for the website structure. This allows attackers to circumvent the restrictions on JavaScript execution.

The vulnerability of the software for managing and controlling access to corporate resources and IBM Security Verify Governance applications is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to circumvent...

Fedora: Security Advisory (FEDORA-2024-6ef42a28c9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Integer Overflow or Wraparound in Microsoft

CVE-2024-20698 About this vulnerability: https://msrc.microsof...

The vulnerability of the Policy Management component of the security monitoring and management tool Trend Micro Apex Central allows attackers to enhance their privileges.

The vulnerability of the Policy Management component of the security monitoring and management tool Trend Micro Apex Central is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow attackers who operate remotely to increase their privileges...