CVE-2024-7466

PMWeb 7.2.00 is affected by a cross-site scripting vulnerability in an unknown functionality of the Web Application Firewall component. The issue allows remote exploitation and has been publicly disclosed. Details in connected sources confirm the vulnerability impact as XSS, affecting PMWeb’s WAF...

CVE-2024-7466 PMWeb Web Application Firewall cross site scripting

A vulnerability has been found in PMWeb 7.2.00 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Application Firewall. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed t...

Best Courier Management System 1.0 SQL Injection

============================================================================================================================================= | Title : Best Courier Management System v1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefo...

PMWeb 跨站脚本漏洞

PMWeb is a web-based platform from PMWeb Inc. It is used to manage the lifecycle of a user's schedule and build operations. A cross-site scripting vulnerability exists in PMWeb version 7.2.00, which stems from an unknown feature of the component Web Application Firewall that can lead to cross-sit...

Simple Machines Forum (SMF) <= 2.1.6 Multiple Vulnerabilities

Simple Machines Forum SMF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-6567

The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fpdi-protection and not preventing direct access to test files that have displayerrors set to true. This makes it possible for unauthenticat...

CVE-2024-6567

CVE-2024-6567 affects the WordPress Ebook Store plugin (versions up to 5.8001). The root cause is a Full Path Disclosure caused by the plugin using fpdi-protection and failing to block direct access to test files that have display_errors enabled. This unauthenticated disclosure can reveal the web...

CVE-2024-41961

Summary of CVE-2024-41961 (Elektra) : Elektra, a Ruby on Rails-based OpenStack dashboard, contains a code injection vulnerability in its live search functionality. An authenticated user can provide a search term that includes Ruby code, which flows to an eval sink and can execute arbitrary code. ...

CVE-2024-41961 Elektra vulnerable to remote code execution in universal search

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

CVE-2024-2090

CVE-2024-2090 — The WordPress plugin Remote Content Shortcode (versions

The vulnerability in the `app\admin\groups\edit-group.php` file of the PHPIPAM web application allows a attacker to perform XSS attacks.

The vulnerability in the app\admin\groups\edit-group.php file of the IP address management web application exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-41954 FOG Weak file permissions

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accoun...

The vulnerability in the `app\admin\groups\edit-group.php` file of the PHPIPAM web application allows a attacker to perform XSS attacks.

The vulnerability in the app\admin\groups\edit-group.php file of the IP address management web application exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

ROS-20240730-12

Vulnerability in Django web application software platform is related to unrestricted resource allocation. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service DoS. denial of service DoS...

IBM Aspera Orchestrator 代码问题漏洞

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide an efficient file processing pipeline for data-driven organizations. A code issue vulnerability exists in IBM Aspera Orchestrator version 4.0.1 that stems from not invalidating a sessi...

AMPLE BILLS 1.0 Administrative Page Disclosure

============================================================================================================================================= | Title : AMPLE BILLS v1.0 Administrative Page Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

The vulnerability of the Express.js template for Node.js web application development, related to the redirection of URL addresses to unreliable websites used by the incoming component, allows attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Express.js template for Node.js web application development is related to open redirection, involving incorrectly formed URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses remotely...

CVE-2024-6566

The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has displayerrors enabled. This makes it possible for...

CVE-2024-6546

The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

CVE-2024-6545

The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full pa...