CVE-2024-0623 VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbpclearpatternscache function. This makes it possible for unauthenticated attackers to clear the...

CVE-2024-20270

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This...

PT-2024-1162 · Oracle · Oracle Business Intelligence Enterprise Edition

Name of the Vulnerable Software and Affected Versions: Oracle Business Intelligence Enterprise Edition versions 6.4.0.0.0 through 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Pod Admin component of Oracle Business Intelligence Enterprise Edition. This can b...

CVE-2023-5448

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the updatepasswordvalidate function. This makes it possible for unauthenticated attackers to res...

Kashipara Food Management System SQL Injection Vulnerability (CNVD-2024-13468)

Kashipara Food Management System is a food management system from Kashipara. A SQL injection vulnerability exists in Kashipara Food Management System version 1.0, which is caused by a lack of validation of the id parameter of the itemeditsubmit.php file against externally entered SQL statements,...

CVE-2024-0333

Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to install a malicious extension via a crafted HTML page. Chromium security severity: High...

PT-2024-1132 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 21.4R3 through 21.4R3-S4 Juniper Networks Junos OS versions 22.1R3 through 22.1R3-S3 Juniper Networks Junos OS versions 22.2R2 through 22.2R3-S1 Juniper Networks Junos OS versions 22.3 through 22.3R2-S2,...

Medium: tomcat9

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header siz...

CVE-2023-6493 Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save

The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

Ubystanitim University Information Management System Path Traversal Vulnerability

Ubystanitim University Information Management System is an information management system. A path traversal vulnerability exists in Ubystanitim University Information Management System version 30.11.2023, which stems from incorrect input validation leading to path traversal...

X.Org Server Damage Object Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Damage...

CVE-2023-6381

Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file file with SMB extension to a user via a link or email attachment and persuade the user to open the file...

Siemens SINEC INS Code Issue Vulnerability

Siemens SINEC INS is a software from Siemens Germany that provides centralized services for network infrastructure. A code issue vulnerability exists in Siemens SINEC INS that stems from an inability to properly validate responses received by the UMC server...

Siemens SINEC INS 信任管理问题漏洞

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in one tool. This simplifies the installation and management of all network services associated with industrial networks. Siemens SINEC INS suffers from a Certificate Validation Improperity...

Tenda AX9 /goform/SetNetControlList Interface Buffer Overflow Vulnerability

Tenda AX9 is a Wi-Fi 6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX9 version V22.03.01.46, which occurs when the "list" parameter of /goform/SetNetControlList fails to correctly validate the length of the input data, and can be exploited by a remote attacker to...

Tenda W30E formAdvancedSetListSet Function Buffer Overflow Vulnerability

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version V16.01.0.124843, which originates from a failure of the formAdvancedSetListSet function to correctly validate the length of the input data, and can be exploited by a remote...

CVE-2023-48421

In gpupixelhandlebufferlivenessupdateioctl of private/google-modules/gpu/malikbase/platform/pixel/pixelgpuslc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User...

VulnCheck KEV: CVE-2023-26067

Certain Lexmark devices through 2023-02-19 mishandle Input Validation issue 1 of 4...

PT-2023-7415 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server version 11.5 CLI Description: The issue is related to insufficient input validation in the database management system, which can be exploited by a remote attacker to cause a deni...