1871 matches found
CVE-2024-29890 Remote code execution in datalens-ui
DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart. The problem w...
CVE-2024-29890
CVE-2024-29890 affects DataLens/DataLens UI components, with a vulnerability in datalens-ui prior to version 0.1449.0. A specially crafted request can create a chart type that passes custom JavaScript, which then executes in an unprotected sandbox on subsequent chart requests. The issue has a kno...
CVE-2024-29890 Remote code execution in datalens-ui
DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart. The problem w...
PT-2024-23113 · Datalens · Datalens
Name of the Vulnerable Software and Affected Versions: DataLens versions prior to 0.1449.0 Description: A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent...
DataLens 安全漏洞
DataLens is a modern business intelligence and data visualization system open-sourced by datalens-tech. A security vulnerability exists in DataLens version 0.1449.0, which stems from the application allowing the creation of special chart types and the ability to pass custom JavaScript code that...
The vulnerability of the Adobe Experience Manager (AEM) content and media data management system, related to the lack of protection for operational data, allows a perpetrator to gain unauthorized access to confidential information.
The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to confidential information...
Softing edgeConnector Siemens Cleartext Transmission of Credentials Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Softing edgeConnector Siemens. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 8099 by default. HTTP...
The vulnerability of Adobe Experience Manager’s content and media data management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary JavaScript code.
The vulnerability of the Adobe Experience Manager AEM content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...
The vulnerability of the insertentry/saveentry function in the phpMyFAQ web application allows a hacker to gain unauthorized access to the application.
The vulnerability of the insertentry/saveentry function in the phpMyFAQ web application is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the application...
The vulnerability in the phpMyFAQ web application allows attackers to perform cross-site scripting (XSS) attacks.
The vulnerability in the phpMyFAQ web application is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using specially created .html files...
The vulnerability of the phpMyFAQ web application lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.
The vulnerability of the phpMyFAQ web application is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request...
GHSA-RF39-3F98-XR7R WiX based installers are vulnerable to binary hijack when run as SYSTEM
Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...
WordPress Plugin Backup Bolt Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
The vulnerability of the Query Parameter Handler component in the IBM TXSeries for Multiplatforms transaction management software solutions, including the IBM CICS TX Standard and IBM CICS TX Advanced application servers, allows a malicious individual to gain unauthorized access to confidential information.
The vulnerability of the Query Parameter Handler component in the IBM TXSeries transaction application management software for multiplatforms, as well as in the IBM CICS TX Standard and IBM CICS TX Advanced application servers, is related to the use of an unprotected communication channel for dat...
The vulnerability of the web-based collaboration tool for planning, creating, managing, and executing tests at all stages of the IBM Engineering Test Management cycle exists due to the lack of protective measures for the website structure. This allows attackers to execute arbitrary JavaScript code.
The vulnerability of the web-based collaboration tool for planning, creating, managing, and executing tests at all stages of the development cycle in IBM Engineering Test Management exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a...
The vulnerability in the Nginx Vhost Traffic Status (nginx-module-vts) web interface allows for cross-site scripting attacks (XSS) to be carried out by attackers who fail to protect the structure of the web page.
The vulnerability of the Nginx Vhost Traffic Status nginx-module-vts web interface is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using specially created HTTP...
CVE-2024-2414
The primary channel is unprotected on Movistar 4G router affecting E version SWLD71-T1v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges...
CVE-2024-2414 Unprotected Primary Channel vulnerability in Movistar 4G router
The primary channel is unprotected on Movistar 4G router affecting E version SWLD71-T1v2.0.201820. This device has the 'adb' service open on port 5555 and provides access to a shell with root privileges...