118 matches found
CVE-2024-11118
CVE-2024-11118 affects the WordPress 404 Error Monitor plugin up to version 1.1. It is a CSRF vulnerability caused by missing nonce validation in updatePluginSettings(), enabling unauthenticated attackers to forge requests that modify plugin settings and clear error logs if a site admin clicks a ...
CVE-2024-52510
creationtimestamp| type| source ---|---|--- 2024-11-15 17:57:23+00:00| seen| https://infosec.exchange/users/cve/statuses/113488261461288267 2024-11-15 19:58:11+00:00| seen| https://t.me/cvedetector/11135...
PT-2024-8143 · Unknown +11 · Postgresql +10
Name of the Vulnerable Software and Affected Versions: PostgreSQL affected versions not specified Description: The issue is related to an inconsistency in the row security policy of PostgreSQL, allowing an attacker to potentially execute arbitrary commands by reusing a query in multiple SET ROLE...
Prototype Pollution
DOMPurify is vulnerable to Prototype Pollution. The vulnerability is due to insufficient sanitization, allowing attackers to manipulate the prototype of JavaScript objects, potentially leading to unexpected behavior or security issues...
CVE-2024-37376
creationtimestamp| type| source ---|---|--- 2024-11-13 03:22:13+00:00| seen| https://infosec.exchange/users/cve/statuses/113473495543964820 2024-11-13 06:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1502/ 2024-11-13 09:12:33+00:00| seen|...
CVE-2024-7982 Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks...
CVE-2024-51682
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasThemes HT Builder – WordPress Theme Builder for Elementor ht-builder allows Stored XSS.This issue affects HT Builder – WordPress Theme Builder for Elementor: from n/a through = 1.3.0...
BELL-CVE-2024-49890
Bulletin has no description...
PT-2024-38010
Name of the Vulnerable Software and Affected Versions lollms-webui affected versions not specified lollms affected versions not specified Description A path traversal issue exists in the lollms file system.py file, specifically affecting the functions add rag database, toggle mount rag database,...
CVE-2024-33668
An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. An attacker could try to brute force them to upload malicious content to article drafts they have no access to...
CVE-2023-45931
Mesa 23.0.4 was discovered to contain a NULL pointer dereference in checkxshm for the haserror state. NOTE: this is disputed because there is no scenario in which the vulnerability was demonstrated...
Google Android suffers from unspecified vulnerability (CNVD-2023-9749338)
Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability. No details of the vulnerability are provided at this time...
CVE-2023-41764 Microsoft Office Spoofing Vulnerability
...
Unspecified Vulnerability in Mattermost (CNVD-2023-55040)
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that can be exploited by an attacker to send an installation request to an application...
PT-2022-36720 · Oracle · Java
Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: The issue is related to a security exception in the Double.parseDouble function, which is called by FloatingDecimal.readJavaFormatString and FloatingDecimal.parseDouble. This suggests a...
PT-2022-7268 · Libde265 +4 · Libde265 +4
Name of the Vulnerable Software and Affected Versions: Libde265 versions 1.0.8 Description: The issue is related to a heap-buffer-overflow vulnerability via the put qpel fallback function in fallback-motion.cc. This allows attackers to cause a Denial of Service DoS via a crafted video file. The...
CVE-2021-39353 Easy Registration Forms <= 2.1.1 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajaxaddform function found in the /includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including...
Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS)
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting. http://example.com/wp-admin/edit.php?posttype=popupbuilder&page=sgpbSubscribers&sgpb-subscribers-date=%22%3E%3Cscript%3Ealert%28origin%29%3C%2Fscript%3E Video:...
Vulnerability in core server (CVE-2020-1720)
ALTER ... DEPENDS ON EXTENSION is missing authorization checks. The ALTER ... DEPENDS ON EXTENSION sub-commands do not perform authorization checks, which can allow an unprivileged user to drop any function, procedure, materialized view, index, or trigger under certain conditions. This attack is...