CVE-2024-45174

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrar...

EMC AlphaStor Library Manager Arbitrary Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'EMC AlphaStor Library Manager Arbitrary Command Execution', 'Description' = %q EMC AlphaStor Library Manager is prone to a remote command-injecti...

Kashipara Music Management System Cross-Site Scripting Vulnerability

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the page parameter of...

Kashipara Music Management System Cross-Site Scripting Vulnerability (CNVD-2024-37431)

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the title and description parameters of...

Kashipara Music Management System Cross-Site Scripting Vulnerability (CNVD-2024-37430)

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which originates from the lack of effective filtering and escaping of the "title" and " action=savemusic" parameters lack effective...

Kashipara Music Management System Cross-Site Scripting Vulnerability (CNVD-2024-37432)

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the page parameter of...

Kashipara Bus Ticket Reservation System Cross-Site Scripting Vulnerability (CNVD-2024-38206)

Kashipara Bus Ticket Reservation System is a bus reservation system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Bus Ticket Reservation System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in /adminschedule.php, and can be...

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools

A flaw was found in the packageindex module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to co...

CVE-2024-20286

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of...

CVE-2024-20284

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of...

CVE-2024-20284 Cisco NX-OS Software Python Parser Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of...

CVE-2024-20284

CVE-2024-20284 : Cisco NX-OS Software contains a vulnerability in the Python interpreter that allows an authenticated, low-privileged, local attacker to escape the Python sandbox and run arbitrary commands on the underlying OS due to insufficient validation of user input. The attack requires Pyth...

CVE-2024-20285 Cisco NX-OS Software Python Parser Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of...

CVE-2024-20286

CVE-2024-20286 : Cisco NX-OS Software contains a vulnerability in the Python interpreter that could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and run arbitrary commands on the device’s underlying OS. The root cause is insufficient validation of user-suppl...

CVE-2024-8182 Flowise Denial of Service

An Unauthenticated Denial of Service DoS vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint...

CVE-2024-8182

Flowise vulnerability CVE-2024-8182 is an unauthenticated Denial of Service affecting Flowise v1.8.2. The issue stems from improper handling of user-supplied input to the /api/v1/get-upload-file endpoint, which can cause the instance to crash when processing requests. The available connected docu...

CVE-2024-8182 Flowise Denial of Service

An Unauthenticated Denial of Service DoS vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint...

CVE-2024-2254 RT Easy Builder – Advanced addons for Elementor <= 2.2 - Authenticated (Contributor+) Stored Cross-site Scripting

The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2024-2254

CVE-2024-2254 affects RT Easy Builder – Advanced addons for Elementor for WordPress. It is a Stored Cross-Site Scripting vulnerability in the plugin’s widgets due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access at cont...

YznCMS Cross-Site Scripting Vulnerability (CNVD-2024-38192)

YznCMS is a backend development framework. A cross-site scripting vulnerability exists in YznCMS version 1.4.2, which stems from the lack of effective filtering and escaping of user-supplied data in the component /index/index.html, and can be exploited by an attacker to execute arbitrary Web scri...