Archive
6 May 2024
Vulnerabilities first published on this day (UTC), newest first.
69 results · Clear filters · Feed
-
Medium 6.5
E-Mail containing malicious display-name information could trigger client-side script execution when using specific mob…
-
Medium 5.9
Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disall…
-
Medium 5.4
MF Gig Calendar <= 1.2.1 - Editor+ Stored XSS
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Medium 5.4
Crelly Slider <= 1.4.5 - Admin+ Stored XSS
The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for…
-
Medium 6.7
In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to…
-
Medium 5.9
In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalatio…
-
Medium 6.7
In da, there is a possible escalation of privilege due to an incorrect status check. This could lead to local escalatio…
-
Medium 4.4
In keyInstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local informati…
-
Medium 5.3
In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of p…
-
Medium 6.4
In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 6.7
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local es…
-
Medium 6.3
Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflow
A vulnerability classified as critical has been found in Shanghai Sunfull Automation BACnet Server HMI1002-ARM 2.0.4. This affects an unknown part of the component Message Handler. The manipulation leads to buffer overflow. The exploit has been disclosed to t…
-
Medium 4.7
Ruijie RG-UAC arp_add_commit.php os command injection
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/networkConfig/ArpTable/arp_add_commit.php. The manipulation of the argument text_ip_addr/text_mac_…
-
Medium 4.7
Ruijie RG-UAC add_commit.php os command injection
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/IPV6/naborTable/add_commit.php. The manipulation of the argument ip_addr/mac_addr leads t…
-
Medium 4.7
Ruijie RG-UAC static_route_edit_ipv6.php os command injection
A vulnerability was found in Ruijie RG-UAC up to 20240428. It has been classified as critical. Affected is an unknown function of the file /view/IPV6/ipv6StaticRoute/static_route_edit_ipv6.php. The manipulation of the argument oldipmask/oldgateway/olddevname …
-
Medium 6.8
Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 a…
-
Medium 6.2
A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remot…
-
Medium 5.3
An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. A…
-
Medium 6.3
An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not termina…
-
Medium 5.5CVE-2024-34472 Public exploit
An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An authenticated blind SQL injection vulnerabil…
-
Medium 5.4CVE-2024-34471 Public exploit
An issue was discovered in HSC Mailinspector 5.2.17-3. A Path Traversal vulnerability (resulting in file deletion) exis…
-
Medium 5.9
SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 al…
-
Medium 5.4
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=u…
-
Medium 6.3
An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be …
-
Medium 5.3
crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.…
-
Medium 5.4CVE-2024-33111 Public exploit
D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php.
-
Medium 6.3
Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.
-
Medium 5.3
D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
-
Medium 4.3
Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker c…