Archive
26 February 2024
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 4.6
Minder trusts client-provided mapping from repo name to upstream ID
Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate …
-
Medium 5.4
Content spoofing - real Hoppscotch emails
Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achie…
-
Medium 5.3
Showdownjs Denial of Service
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
-
Medium 4.6
Kirby cross-site scripting (XSS) in the link field "Custom" type
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any …
-
Medium 5.3
WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: from n/a through 1.0.9.
-
Medium 5.3
Suricata http2: header handling evasion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3.
-
Medium 6.4
Clickjacking vulnerability in Sunny Webbox
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.
-
Medium 6.5
EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the so…
-
Medium 6.7
Local Privilege Escalation via DLL Hijacking
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are …
-
Medium 6.3
Remote Code Execution attack on LG Signage
This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.
-
Medium 6.3
SourceCodester Employee Management System myprofile.php sql injection
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /myprofile.php. The manipulation of the argument id with the input 1%20or%201=1 leads t…
-
Medium 6.3
SourceCodester Employee Management System cancel.php sql injection
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cancel.php. The manipulation of the argument id with the input 1%20or%201=1 l…
-
Medium 6.5
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute…
-
Medium 6.1
Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remt…
-
Medium 6.5CVE-2024-25082 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
-
Medium 6.5
nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
-
Medium 6.5
flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
-
Medium 5.5
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.
-
Medium 4.2CVE-2024-25081 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
-
Medium 4.3
libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js befor…
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b…
-
Medium 5.3
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
-
Medium 5.5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platfor…
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams bef…