CVE-2024-33978 Cross-site Scripting in Janobe E-Negosyo System

Cross-Site Scripting XSS vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'...

BELL-CVE-2024-42099

Bulletin has no description...

Unspecified Vulnerability in SyroTech SY-GPON-1110-WDONT

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. A security vulnerability exists in the SyroTech SY-GPON-1110-WDONT that stems from improper implementation of a password policy. An attacker can exploit this vulnerability to launch further attacks on the system...

The vulnerability of the GLPI system for handling requests and incidents, related to the disclosure of confidential information to unauthorized individuals, allows a violator to disclose confidential data.

The vulnerability of the GLPI system for handling requests and incidents involves the disclosure of confidential information to unauthorized individuals. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose confidential data...

CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

The vulnerability of the PowerScale OneFS operating system, related to access control errors, allows attackers to escalate their privileges.

The vulnerability of the PowerScale OneFS operating system is related to access control errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

Criminal Gang Physically Assaulting People for Their Cryptocurrency

This is pretty horrific: …a group of men behind a violent crime spree designed to compel victims to hand over access to their cryptocurrency savings. That announcement and the criminal complaint laying out charges against St. Felix focused largely on a single theft of cryptocurrency from an elder...

Google Android Framework elevation of privilege vulnerability (CNVD-2025-18827)

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android Framework due to an error in a framework component that can be exploited by an attacker to gain elevated privileges on the system...

Microsoft Windows Remote Desktop Licensing Remote Code Execution Vulnerability

Microsoft Windows Remote Desktop Licensing is a remote desktop licensing service that allows users to connect interactively to remote computers. A remote code execution vulnerability exists in Microsoft Windows Remote Desktop Licensing, which is caused by a flaw in the Remote Desktop Licensing...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to carry out cross-site scripting attacks...

Siemens RUGGEDCOM ROS Information Disclosure Vulnerability (CNVD-2024-31234)

Siemens RuggedCom ROS is an operating system from Siemens, Germany, used in the RuggedCom series of switches. An information disclosure vulnerability exists in Siemens RUGGEDCOM ROS, which can be exploited by an attacker to expose sensitive system information to unauthorized control...

CVE-2024-38971

vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting XSS in the system backend...

Security Bulletin: IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation.

Summary IBM PowerVM Novalink is vulnerable because jose4j is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted p2c value, a remote attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details...

Home Owners Collection Management System SQL Injection Vulnerability

Home Owners Collection Management System is a homeowners collection management system. A SQL injection vulnerability exists in Home Owners Collection Management System version 1.0, which originates from the parameter id of the file /classes/Master.php?f=deletecategory that can lead to SQL injecti...

The vulnerability of the Labvantage LIMS file /labvantage/rc?command=page&page=LV_ViewSampleSpec&oosonly=Y&_sdialog=Y allows a attacker to execute XSS attacks.

The vulnerability of the Labvantage LIMS file /labvantage/rc?command=page&page=LVViewSampleSpec&oosonly=Y&sdialog=Y is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks through the...

PT-2024-37572 · Labvantage · Labvantage Lims

Name of the Vulnerable Software and Affected Versions: LabVantage LIMS version 2017 WPML affected versions not specified Description: A problematic issue affects the processing of the file "/labvantage/rc?command=page" of the component POST Request Handler. The manipulation of the argument param1...

CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

Schneider Electric Modicon M340 Denial of Service Vulnerability

The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. A denial of service vulnerability exists in the Schneider Electric Modicon M340, which can be exploited by an attacker to prevent a use...

Shenzhen Guoxin Synthesis image system security vulnerability

Shenzhen Guoxin Synthesis image system is an image system from Shenzhen Guoxin Synthesis, a company based in Shenzhen, China. A security vulnerability exists in the Shenzhen Guoxin Synthesis image system, version prior to 8.3.0, which stems from a discrepancy in the error response that allows...