Archive
4 May 2024
Vulnerabilities first published on this day (UTC), newest first.
17 results · Feed
-
High 8.8
Tenda i21 formGetDiagnoseInfo stack-based overflow
A vulnerability classified as critical was found in Tenda i21 1.0.0.14(4656). This vulnerability affects the function formGetDiagnoseInfo. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack can be initiated remotely. Th…
-
Medium 5.3
IBM Aspera Orchestrator information disclosure
IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.
-
Medium 4.3
Import and export users and customers <= 1.26.5 - Missing Authorization
The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This mak…
-
Medium 5.4
Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. …
-
Medium 5.4
ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, wit…
-
High 8.8
ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection
The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for …
-
Medium 5.4
Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name
The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenti…
-
High 7.5
TCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer overflow when trying to add…
-
Medium 6.1
Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.
-
Medium 5.3
An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message …
-
Medium 6.5
Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting
The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)
-
Critical 9.8
Zenario uses Twig filters insecurely in the Twig Snippet plugin
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
-
Medium 6.1
ThinkPHP Cross-Site Scripting Vulnerability
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.
-
Medium 5.3
Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs…
-
High 7.5
Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: gmm…
-
High 7.1CVE-2024-34469 Public exploit
Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.
-
Medium 6.1
Alinto SOGo through 5.10.0 allows XSS during attachment preview.