Archive
6 August 2024
Vulnerabilities first published on this day (UTC), newest first.
160 results · Feed
-
Medium 6.4
WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting
The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authentica…
-
Medium 6.5
Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a use…
-
Medium 6.3
itsourcecode Tailoring Management System setlogo.php unrestricted upload
A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /setlogo.php. The manipulation of the argument bgimg leads to unrestricted upload…
-
High 7.3
itsourcecode Bike Delivery System contact_us_action.php sql injection
A vulnerability, which was classified as critical, was found in itsourcecode Bike Delivery System 1.0. Affected is an unknown function of the file contact_us_action.php. The manipulation of the argument name leads to sql injection. It is possible to launch th…
-
Medium 6.5
Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Metho…
-
Medium 4.2CVE-2024-7009 EPSS 14%
Calibre SQL Injection
Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
-
Medium 5.4
Calibre Reflected Cross-Site Scripting (XSS)
Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
-
Critical 9.8
Calibre Remote Code Execution
Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
-
High 7.5
Calibre Arbitrary File Read
Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
-
Medium 6.3
itsourcecode Airline Reservation System admin_class.php save_settings unrestricted upload
A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function save_settings of the file admin/admin_class.php. The manipulation of the argument img leads to unrestricted upload.…
-
Critical 10.0
Inproper Sanitation of field leading to stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.
-
Medium 6.3
itsourcecode Airline Reservation System flights.php sql injection
A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file flights.php. The manipulation of the argument departure_airport_id leads to sql …
-
High 7.3
itsourcecode Airline Reservation System Admin Login Page login.php login2 sql injection
A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been classified as critical. Affected is the function login/login2 of the file /admin/login.php of the component Admin Login Page. The manipulation of the argument username leads…
-
High 8.6
EL Injection Vulnerability in Hitachi Tuning Manager
Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.
-
Medium 6.7
An unquoted executable path exists in Hitachi Device Manager
Unquoted Executable Path vulnerability in Hitachi Device Manager on Windows (Device Manager Server component).This issue affects Hitachi Device Manager: before 8.8.7-00.
-
Medium 6.3
itsourcecode Airline Reservation System index.php file inclusion
A vulnerability was found in itsourcecode Airline Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/index.php. The manipulation of the argument page leads to file inclusion. The attack may be init…
-
High 8.8
Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode
The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…
-
High 7.2
Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting
The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX function in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This make…
-
High 8.8
Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload
The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with co…
-
High 7.2
CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with admin…
-
Medium 6.3
itsourcecode Airline Reservation System index.php file inclusion
A vulnerability has been found in itsourcecode Airline Reservation System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack can be initiate…
-
Medium 6.3
itsourcecode Laravel Accounting System HomeController.php unrestricted upload
A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. …
-
Medium 6.1
ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Inje…
-
Critical 9.1
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another …
-
Medium 6.5
An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AX…
-
Medium 4.3CVE-2024-39226 EPSS 20%
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800…
-
Critical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800…
-
Critical 9.8
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800…
-
Critical 9.8CVE-2024-39225 EPSS 14%
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800…
-
Medium 6.1
Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via …
-
Critical 9.6CVE-2024-28739 EPSS 19%
An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the fo…
-
Medium 5.5CVE-2024-36424 Public exploit
K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of…
-
High 7.5
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1…
-
High 7.2
Microweber Reflected Cross-site scripting (XSS) vulnerability
A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter.
-
Critical 9.1
Gorush uses deprecated TLS versions
An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.
-
High 8.8
A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary…
-
High 8.8
D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to e…
-
High 7.0
1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communi…
-
Medium 6.3
1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific secur…