Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
1,283 results · Clear filters · Feed
-
Medium 5.3
Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU…
-
Medium 5.3
An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. It provides information…
-
Medium 5.4
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update.
-
Medium 6.1
Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfi…
-
Medium 5.9
In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated cus…
-
Medium 6.1
Subrion CMS vulnerable to Cross Site Scripting
Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.
-
Medium 6.1
An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges…
-
Medium 6.1
Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attack…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious …
-
Medium 5.4
A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious Java…
-
Medium 6.1
KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may…
-
Medium 4.6
Minder trusts client-provided mapping from repo name to upstream ID
Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate …
-
Medium 5.4
Content spoofing - real Hoppscotch emails
Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achie…
-
Medium 5.3
Showdownjs Denial of Service
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
-
Medium 4.6
Kirby cross-site scripting (XSS) in the link field "Custom" type
Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any …
-
Medium 5.3
WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit.This issue affects WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit: from n/a through 1.0.9.
-
Medium 5.3
Suricata http2: header handling evasion
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3.
-
Medium 6.4
Clickjacking vulnerability in Sunny Webbox
Vulnerability whereby an attacker could send a malicious link to an authenticated operator, which could allow remote attackers to perform a clickjacking attack on Sunny WebBox firmware version 1.6.1 and earlier.
-
Medium 6.5
EDS-4000/G4000 Series IP Forwarding Vulnerability
The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the so…
-
Medium 6.7
Local Privilege Escalation via DLL Hijacking
A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are …
-
Medium 6.3
Remote Code Execution attack on LG Signage
This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.
-
Medium 6.3
SourceCodester Employee Management System myprofile.php sql injection
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /myprofile.php. The manipulation of the argument id with the input 1%20or%201=1 leads t…
-
Medium 6.3
SourceCodester Employee Management System cancel.php sql injection
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cancel.php. The manipulation of the argument id with the input 1%20or%201=1 l…
-
Medium 6.5
An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute…
-
Medium 6.1
Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remt…
-
Medium 6.5CVE-2024-25082 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
-
Medium 6.5
nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
-
Medium 6.5
flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
-
Medium 5.5
openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.
-
Medium 4.2CVE-2024-25081 Public exploit
Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
-
Medium 4.3
libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js befor…
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b…
-
Medium 5.3
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
-
Medium 5.5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platfor…
-
Medium 6.1
A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams bef…
-
Medium 6.3
SourceCodester Complaint Management System Lodge Complaint Section register-complaint.php unrestricted upload
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file users/register-complaint.php of the component Lodge Complaint Section. The manipulation leads to unr…
-
Medium 5.9
Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug …
-
Medium 5.4
IBM Cognos Analytics cross-site scripting
IBM Cognos Analytics 11.1.7, 11.2.4, and 12.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with…