CVE-2024-25638

CVE-2024-25638 affects the dnsjava library (Java DNS impl). The issue: DNS replies can include Resource Records from zones unrelated to the query, due to missing validation of RR relevance. This could enable attacker-controlled responses to spoof data. Root cause: insufficient verification of RR ...

PT-2024-34405 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

WordPress plugin Gutenberg Forms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Jungo WinDriver Denial of Service Vulnerability (CNVD-2024-34415)

Jungo WinDriver is a device driver development toolkit from Israel's Jungo that supports any device, regardless of its chip vendor, with the ability to focus on the value-added functionality of the driver rather than the operating system internals. A denial of service vulnerability exists in...

CVE-2024-39307 Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox the contents of epubs, allowing scripts inside ebooks to execute. This vulnerability was patched in version 0.8.1...

PX4 Drone Autopilot Security Vulnerability

PX4 Drone Autopilot is a PX4 Drone Autopilot for Drones open source. A security vulnerability exists in PX4 Drone Autopilot version v1.12.3. An attacker has exploited the vulnerability to cause a denial of service DoS via a specially crafted MavLink message...

PT-2024-25710 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. When ...

WordPress plugin Averta Master Slider security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

Paradox IP150 Cross-Site Request Forgery Vulnerability

Paradox IP150 is a communication module from Paradox USA that provides monitoring and management of Paradox devices over the web. The module provides a web interface to monitor and manage connected Paradox devices. A security vulnerability exists in Paradox IP150 version 1.40.00, which stems from...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-27887)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Easyadmin 跨站脚本漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker individual developers. A cross-site scripting vulnerability exists in Easyadmin 20240324 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the parameter file of file /sys/file/upload...

WordPress Similarity Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

Software Similarity Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3972 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3941fac517e1 Credits Bob Matyas Required privilege...

PT-2024-26372 · Docker +3 · Docker +3

Name of the Vulnerable Software and Affected Versions: Trivy versions prior to 0.51.2 Description: A malicious actor can trigger Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry AC...

GitLab 11.9 < 15.9.6 / 15.10 < 15.10.5 / 15.11 < 15.11.1 (CVE-2023-1265)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The...

WordPress plugin TranslatePress 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. WordPress plugin...

PT-2024-29868 · Digisol · Digisol Router

Name of the Vulnerable Software and Affected Versions: Digisol Router DG-GR1321 version v3.2.02 Description: This issue is caused by the lack of encryption or hashing in storing passwords within the router's firmware/database. An attacker with physical access could exploit this by extracting the...

SolidUI 安全漏洞

SolidUI is an AI-generated graphics software open-sourced by CloudOrc in China. A security vulnerability exists in SolidUI version 0.4.0, which stems from the fact that spaceplugin/app.py leaks OpenAI keys...

CVE-2024-32973 Remote for TLS session may be trusted despite constraints in Pluto lang

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. In affected versions an attacker with the ability to actively intercept network traffic would be able to use a specifically-crafted certificate to fool Pluto into trusting it to be the intended remote for the TLS session...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE. An attacker exploited the...

WP-PostRatings 跨站脚本漏洞

WP-PostRatings is a plugin for adding comment functionality. A cross-site scripting vulnerability exists in WP-PostRatings version 1.64 and earlier, which stems from the presence of a location section in wp-postratings.php that leads to cross-site scripting...