Archive
August 2024
Vulnerabilities first published in this month (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 5.3CVE-2022-4539 Public exploit
Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass
The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restr…
-
Medium 6.8CVE-2024-35133 Public exploit
IBM Security Verify Access HTTP open redirect
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploi…
-
Medium 5.3CVE-2024-45440 Public exploit
Drupal Full Path Disclosure
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
-
Medium 6.1CVE-2024-41358 Public exploit
phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
-
Medium 6.4CVE-2024-43788 Public exploit
DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulner…
-
Medium 4.8CVE-2022-39996 Public exploit
Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cm…
-
Medium 6.1CVE-2024-7313 Public exploit
Shield Security < 20.0.6 - Reflected XSS
The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Medium 5.3CVE-2024-45244 Public exploit
Hyperledger Fabric does not verify request has a timestamp within the expected time window
Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.
-
Medium 4.8CVE-2024-40111 Public exploit
A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. This vulne…
-
Medium 4.3
FastAdmin lang path traversal
A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attac…
-
Medium 5.3CVE-2024-35538 Public exploit
Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP…
-
Medium 6.5CVE-2024-35539 Public exploit
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerabi…
-
Medium 6.1CVE-2024-23729 Public exploit
The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute…
-
Medium 6.4CVE-2024-7703 Public exploit
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sani…
-
Medium 6.5CVE-2024-42849 Public exploit
An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change …
-
Medium 5.4CVE-2024-42758 Public exploit
A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabl…
-
Medium 4.2CVE-2024-38143 Public exploit
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
-
Medium 6.8CVE-2024-6768 Public exploit
Denial of Service in CLFS.sys
A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx fu…
-
Medium 6.5
Microsoft Office Spoofing Vulnerability
Microsoft Office Spoofing Vulnerability
-
Medium 6.1
WordPress File Upload < 4.24.8 - Reflected XSS
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 5.5CVE-2024-36424 Public exploit
K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of…
-
Medium 6.6CVE-2024-41958 Public exploit
Two-Factor Authentication (2FA) Bypass in mailcow: dockerized
mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized a…
-
Medium 6.0CVE-2024-21978 Public exploit
Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially l…
-
Medium 6.0CVE-2023-31355 Public exploit
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC …
-
Medium 5.3CVE-2024-42461 Public exploit
Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
-
Medium 5.3
TVT DVR TD-2104TS-CL queryDevInfo information disclosure
A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to inf…