CVE-2024-11777

The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sellmediasearchformgutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

Mozilla Firefox ESR < 128.6

The version of Firefox ESR installed on the remote Windows host is prior to 128.6. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-02 advisory. - Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird...

CVE-2024-20148

A security vulnerability exists in MediaTek chipsets affecting the wlan STA FW module. The issue is caused by improper input validation , which can lead to a possible out-of-bounds write . This flaw could allow an attacker to achieve remote (proximal/adjacent) code execution without requiring add...

RLSA-2024:10779 Moderate: python3:3.6.8 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 8 : python3:3.6.8 (RLSA-2024:10779)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10779 advisory. python: Virtual environment venv activation scripts don't quote paths CVE-2024-9287 python: Improper validation of IPv6 and IPvFuture addresses...

Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java and IBM WebSphere Application Server Liberty

Summary There are multiple vulnerabilities in Java and IBM WebSphere Application Server Liberty used by IBM Cloud Transformation Advisor CVE-2024-7254, CVE-2022-46363, CVE-2015-2156, CVE-2020-11612. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol...

CVE-2024-1610 OPPO Store app include remote account token hijacking and sensitive information leakage

In OPPO Store APP, there's a possible escalation of privilege due to improper input validation...

CVE-2024-11336

The Clickbank WordPress Plugin Storefront plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the csmenu page. This makes it possible for unauthenticated attackers to update settings a...

IrfanView DXF File Parsing Type Obfuscation Remote Code Execution Vulnerability

IrfanView is an image viewer. It supports image browsing, image editing, image format conversion and so on. A type-obfuscated remote code execution vulnerability exists in IrfanView DXF file parsing, which is caused by a lack of proper validation of user-supplied data and can be exploited by an...

Mozilla Firefox ESR < 128.5

The version of Firefox ESR installed on the remote Windows host is prior to 128.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-64 advisory. - Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed...

RockyLinux 9 : podman (RLSA-2024:9051)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:9051 advisory. Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction CVE-2024-9407 buildah: Buildah allows arbitra...

squid: Denial of Service processing ESI response content

A flaw was found in Squid. Due to input validation and resource management issues, a denial of service may be triggered during the processing of certain Edge Side Includes ESI response content...

The vulnerability of the InnoDB component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions using the network MySQL protocol...

Cross Site Scripting(XSS)

LibreNMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper validation and sanitization of user-uploaded SVG files, allowing users with the "admin" role to upload these files as backgrounds for custom maps without sufficient security checks, which enables...

PT-2024-31450

Name of the Vulnerable Software and Affected Versions UCI IDOL 2 versions through 2.12 Description The issue is caused by improper input validation, improper deserialization, and improper restriction of operations within the bounds of a memory buffer. This makes UCI IDOL 2 vulnerable to...

CVE-2024-35284

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35283

A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting XSS attack due to insufficient input validation...

Siemens SIMATIC WinCC Denial of Service Vulnerability (CNVD-2024-17302)

SIMATIC PCS 7 is a process control system.SIMATIC WinCC is an automated data acquisition and monitoring SCADA system.SIMATIC WinCC Runtime Professional is used for operator visualization of the runtime platform for the control and monitoring of machines and equipment. A denial of service...

PT-2024-3122 · Microsoft · Ole Db Driver For Sql Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft OLE DB Driver for SQL Server affected versions not specified Description: The issue exists due to insufficient input validation in the Microsoft OLE DB Driver for SQL Server. This allows a remote attacker to execute arbitrary code...

CVE-2024-22126

CVE-2024-22126 – SAP NetWeaver AS Java (User Admin) XSS : The User Admin application in SAP NetWeaver AS Java 7.50 insufficiently validates and improperly encodes incoming URL parameters before including them in the redirect URL, enabling Cross-Site Scripting. Impact: high confidentiality impact;...