Archive
16 August 2024
Vulnerabilities first published on this day (UTC), newest first.
30 results · Clear filters · Feed
-
Medium 6.5
IBM QRadar Suite Software information disclosure
IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information …
-
Medium 5.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
-
Medium 5.3
PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
When performing an online tag generation to devices which communicate using the ControlLogix protocol, a machine-in-the-middle, or a device that is not configured correctly, could deliver a response leading to unrestricted or unregulated resource allocation. …
-
Medium 4.6
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
-
Medium 4.6
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
-
Medium 5.0
reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning
reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs when scanning a domain, and if the target domain's DNS record contains an X…
-
Medium 5.4
Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In versions on the 1.15.x branch prior to 1.15.8 and the 1.16.x branch prior to 1.16.1, ReferenceGrant changes are not correctly propagated in Cilium's GatewayAPI contr…
-
Medium 6.5
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on …
-
Medium 6.5
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on …
-
Medium 6.5
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on …
-
Medium 6.5
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on …
-
Medium 6.5
A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on …
-
Medium 6.4
JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' and 'slide_id' parameters in all versions up to, and including, 2.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authen…
-
Medium 6.4
JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The JetSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, …
-
Medium 6.4
JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
The JetBlocks for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple placeholder parameters in all versions up to, and including, 1.3.12 due to insufficient input sanitization and output escaping. This makes it possible f…
-
Medium 6.8
Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability
Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code execution, for example to obtain a Linux Shell with the same privileges as the attacker. The attacker would…
-
Medium 4.2
Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This mak…
-
Medium 4.3
Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unau…
-
Medium 4.4
Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting
The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookie_notice_options[refuse_code_head]' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and …
-
Medium 4.3
Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode
The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user controlled key. This makes…
-
Medium 5.3
Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Premium) via the relevanssi_do_query() due to insufficient limitations on the posts that are returned w…
-
Medium 6.3
SourceCodester Yoga Class Registration System sql injection
A vulnerability was found in SourceCodester Yoga Class Registration System up to 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=categories/view_category. The manipulation of the argument id leads to sql injec…
-
Medium 6.3
SourceCodester Yoga Class Registration System Add User Users.php improper authorization
A vulnerability has been found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This vulnerability affects unknown code of the file /classes/Users.php?f=save of the component Add User Handler. The manipulation leads to improper…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to ex…
-
Medium 6.5CVE-2024-42849 Public exploit
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change …
-
Medium 5.4CVE-2024-42758 Public exploit
A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabl…
-
Medium 4.7
A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attacker…
-
Medium 4.7
A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker …
-
Medium 4.9
An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to …