Archive
22 October 2024
Vulnerabilities first published on this day (UTC), newest first.
83 results · Feed
-
High 8.3
Post-auth Arbitrary File Read in the Server Plugins Section
A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature. This issue affects Pandora FMS: from 700 through <777.3.
-
High 8.6
SQL Injection in CSV Module Data Collection
A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality. This issue affects Pandora FMS: from 700 through <777.3.
-
Unscored —
nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Handle memory allocation failure from nci_skb_alloc() (calling alloc_skb()) to avoid possible NULL pointer dereference.
-
Unscored —
media: pci: cx23885: check cx23885_vdev_init() return
In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go…
-
Medium 4.3
News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated at…
-
Medium 5.5
Category and Taxonomy Image <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attribute…
-
Medium 5.5
Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and ou…
-
Medium 5.5
Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization an…
-
Medium 5.4
Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible fo…
-
High 8.6
TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure
The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_process' function in all versions up to, and including, 1.3. This makes it possible for unauthenticat…
-
Medium 5.3CVE-2024-8852 Scanner template
All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially…
-
Medium 6.3
Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attacker…
-
High 8.8
Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'rover_idx_refresh_social_callback' function. This makes it possible for…
-
Medium 5.5
The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version…
-
High 8.4CVE-2022-23862 Public exploit
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 969…
-
Medium 6.1CVE-2022-23861 Public exploit
Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the…
-
High 8.2
An issue in the server_handle_regular function of the test_coap_server.c file within the FreeCoAP project allows remote…
-
High 7.5
Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports para…
-
Medium 5.4
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform w…
-
Medium 4.6CVE-2024-48415 Public exploit
itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastn…
-
Medium 5.3CVE-2024-48644 Public exploit
Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23…
-
High 7.8CVE-2024-48605 Public exploit
An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper …
-
High 8.1
SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to e…
-
Medium 5.4
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit w…
-
Medium 4.8CVE-2024-48652 Public exploit
camaleon_cms affected by cross site scripting
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field.
-
Medium 5.4
Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action…
-
Medium 5.4
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacke…
-
Critical 9.8CVE-2024-46483 Public exploit
Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which …
-
High 8.2
An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3…
-
Critical 9.3
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML …
-
Medium 4.8
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/c…
-
Medium 5.3
Security Update for the OPC UA .NET Standard Stack
An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. A remote attacker can send requests with invalid credentials and cause the server performance to degrade gradually.
-
High 7.5CVE-2024-45518 EPSS 21%
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41…
-
Critical 9.8
Buffer Overflow in coap_msg.c in FreeCoAP allows remote attackers to execute arbitrary code or cause a denial of servic…
-
Medium 5.3
Null Pointer Dereference in `coap_client_exchange_blockwise2` function in Keith Cullen FreeCoAP 1.0 allows remote attac…
-
High 7.5
Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cau…
-
Critical 9.8CVE-2024-44812 Public exploit
SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the user…
-
High 7.5
Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misalign…
-
Critical 9.0
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a c…
-
Medium 5.2
Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.…