PHPGurukul Men Salon Management System 安全漏洞

PHPGurukul Men Salon Management System is a men's salon management system from the US company PHPGurukul. A security vulnerability exists in PHPGurukul Men Salon Management System version v2.0. An attacker can exploit this vulnerability to conduct an SQL injection attack via the "username"...

PT-2024-40525 · Silverstripe · Silverstripe/Subsites

Name of the Vulnerable Software and Affected Versions: silverstripe/subsites versions prior to 2.1.1 Description: A potential SQL injection issue has been identified in the silverstripe/subsites module. The issue has been fixed in version 2.1.1. Recommendations: For versions prior to 2.1.1, updat...

ORing IAP-420 跨站脚本漏洞

The ORing Net IAP-420+ is a wireless access point from China Power ORing. A cross-site scripting vulnerability exists in the ORing IAP-420 2.01e and prior versions, which stems from a lack of input validation in the web interface, resulting in cross-site scripting...

ORing IAP-420 跨站脚本漏洞

The ORing Net IAP-420+ is a wireless access point from China Power ORing. A security vulnerability exists in ORing IAP-420 version 2.01e and prior versions, which stems from a lack of input validation and operating system command integration for input in the web interface, resulting in command...

libigl 安全漏洞

libigl is a simple C++ geometry processing library open-sourced by libigl. A security vulnerability exists in libigl version v2.4.0. An attacker has exploited the vulnerability to cause a buffer overflow via a specially crafted .off file...

PT-2024-35780 · Unknown · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A critical issue has been found in the PHPGurukul Zoo Management System, affecting an unknown functionality of the file /admin/forgot-password.php. The manipulation of the email argume...

Zoo Management System SQL注入漏洞

Zoo Management System is a zoo management system by the individual developer Carlo Montero. It provides an online and automated platform for zoo organizations to manage their daily records. A SQL injection vulnerability exists in version 2.1 of the PHPGurukul Zoo Management System, which stems fr...

CVE-2024-4455

The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2024-1332

The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author...

Box-IM 安全漏洞

Box-IM is an open source Box-IM chat tool modeled after WeChat. A security vulnerability exists in Box-IM v2.0, which originates from an arbitrary file upload vulnerability in the upload function, allowing an attacker to execute arbitrary code by uploading a well-designed PDF file...

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...

golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS

A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service DoS attack...

SUSE CVE-2023-52866

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Fix user-memory-access bug in uclogicparamsugeev2initeventhooks When CONFIGHIDUCLOGIC=y and CONFIGKUNITALLTESTS=y, launch kernel and then the below user-memory-access bug occurs. In...

WordPress Awesome Contact Form7 for Elementor plugin <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via AEP Contact Form 7 Widget vulnerability discovered by stealthcopter in WordPress Plugin Awesome Contact Form7 for Elementor versions = 2.9...

CVE-2024-3648

The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

Tomcat: HTTP/2 header handling DoS

A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn't reset immediately. Instead, the reset action occurs only aft...

CVE-2023-6487

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-22935 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is related to Stored Cross-Site Scripting via multiple parameters due to insufficient input sanitization and output escaping. This allo...

PT-2024-31286 · WordPress · Awesome Contact Form7

Name of the Vulnerable Software and Affected Versions: Awesome Contact Form7 for Elementor plugin for WordPress versions up to, and including, 2.9 Description: The issue is related to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget due to insufficient input sanitization and output...