Archive
September 2024
Vulnerabilities first published in this month (UTC), newest first.
1,072 results · Clear filters · Feed
-
Medium 4.8
IBM WebSphere Application Server cross-site scripting
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…
-
Medium 4.8
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in…
-
Medium 5.1
Alist Contains a Reflected Cross-Site Scripting Vulnerability
AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an a…
-
Medium 4.6
Scout contains insufficient output escaping of attachment names
Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass intended file extension and make users download malicious files with any extension. With malicious content injected inside the file data and …
-
Medium 5.4
Scout contains an Open Redirect on Login via `next`
Scout is a web-based visualizer for VCF-files. Open redirect vulnerability allows performing phishing attacks on users by redirecting them to malicious page. /login API endpoint is vulnerable to open redirect attack via next parameter due to absence of saniti…
-
Medium 5.4
Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The inform…
-
Medium 6.3
Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. Th…
-
Medium 6.2
Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciou…
-
Medium 5.3
MantisBT vulnerable to information disclosure with user profiles
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. This vulnerability is fixed in 2.26.4.
-
Medium 4.3
Cross Application Scripting in Redlink SDK
Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnerable application.This issue affects Redlink SDK versions through 1.13.
-
Medium 6.5
WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muhammad Shakeel Confetti Fall Animation confetti-fall-animation allows Stored XSS.This issue affects Confetti Fall Animation: from n/a through <= 1.3.0.
-
Medium 5.1
Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. The deprecated org.apache.lucene.replicator.http package is affected. The org.apache.lucene.replicator…
-
Medium 6.8
Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerabilit…
-
Medium 4.8
PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management
Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack.
-
Medium 5.3
PLANET Technology switch devices - Swctrl service DoS attack
The swctrl service is used to detect and remotely manage PLANET Technology devices. Certain switch models have a Denial-of-Service vulnerability in the swctrl service, allowing unauthenticated remote attackers to send crafted packets that can crash the servic…
-
Medium 4.9
PLANET Technology switch devices - Weak hash for users' passwords
Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to ret…
-
Medium 6.9
Glassfish redirect to untrusted site
In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may success…
-
Medium 6.8
PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials
Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to connect to the device via the serial console and use this credential to reset any user's password.
-
Medium 5.4
Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cros…
-
Medium 4.8
Slider by 10Web < 1.2.59 - Admin+ Stored XSS
The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f…
-
Medium 5.4
Starbox < 3.5.3 - Contributor+ Stored XSS
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role …
-
Medium 4.8
The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disa…
-
Medium 4.3
An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 B…
-
Medium 6.6
An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @C…
-
Medium 6.5
An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @…
-
Medium 4.8
A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows a…
-
Medium 6.3
A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attack…
-
Medium 5.9CVE-2024-46635 Public exploit
An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access s…
-
Medium 6.3
TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eav…
-
Medium 6.5
Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
-
Medium 6.3CVE-2024-45200 Public exploit
In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to …
-
Medium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts…
-
Medium 6.3
SourceCodester Advocate Office Management System edit_client.php sql injection
A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /control/edit_client.php. The manipulation of the argument id leads to sql injection. The …
-
Medium 6.3
code-projects Blood Bank System forgot.php sql injection
A vulnerability was found in code-projects Blood Bank System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot.php. The manipulation of the argument useremail leads to sql injection. The attack can be initiated…
-
Medium 6.3
Intelbras InControl Relatório de Operadores Page operador code injection
A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument field…
-
Medium 6.3
code-projects Supply Chain Management edit_manufacturer.php sql injection
A vulnerability was found in code-projects Supply Chain Management 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit_manufacturer.php. The manipulation of the argument id leads to sql injection. It is possible to…
-
Medium 5.3
SourceCodester Online Railway Reservation System view_details.php access control
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/inquiries/view_details.php. The manipulation of the argument id leads to improper acces…
-
Medium 6.3
SourceCodester Online Timesheet App delete-timesheet.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible…
-
Medium 6.3
SourceCodester Advocate Office Management System activate.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql…
-
Medium 6.3
SourceCodester Online Eyewear Shop Master.php delete_category sql injection
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql inje…