Archive
December 2024
Vulnerabilities first published in this month (UTC), newest first.
3,472 results · Feed
-
Medium 6.3
There is a stack overflow vulnerability in some Huawei smart phone. An attacker can craft specific packet to exploit th…
-
High 8.8
There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does n…
-
High 7.0
There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on spec…
-
Medium 6.4
There is an out-of-bound read and write vulnerability in Huawei smartphone. A module dose not verify the input sufficie…
-
Medium 6.8
There is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity che…
-
High 7.1
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger th…
KEV Dec 30, 2024 -
Low 3.3
There is an information vulnerability in Huawei smartphones. A function in a module can be called without verifying the…
-
Medium 4.3
There is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message…
-
Medium 5.3
There is a NULL pointer dereference vulnerability in some Huawei products. An attacker may send specially crafted POST …
-
Low 3.5
There is an information disclosure vulnerability in several smartphones. The system has a logic judging error under cer…
-
Low 3.5
There is an improper authorization vulnerability in some Huawei smartphones. An attacker could perform a series of oper…
-
High 7.8
There is an improper privilege management vulnerability in Huawei smart phone product. A local, authenticated attacker …
-
Low 2.4
code-projects Hospital Management System Edit Doctor Details Page manage-doctors.php cross site scripting
A vulnerability classified as problematic has been found in code-projects Hospital Management System 1.0. This affects an unknown part of the file /hospital/hms/admin/manage-doctors.php of the component Edit Doctor Details Page. The manipulation of the argume…
-
Low 2.4
PHPGurukul Blood Bank & Donor Management System update-contactinfo.php cross site scripting
A vulnerability was found in PHPGurukul Blood Bank & Donor Management System 2.4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /bbdms/admin/update-contactinfo.php. The manipulation of the argument Address …
-
Medium 4.8CVE-2024-11921 Scanner template
Give < 3.19.0 - Reflected XSS
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Medium 4.3
DN Shipping by Weight for WooCommerce < 1.2 - Settings Update via CSRF
The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Medium 4.8
Float Block <= 1.7 - Admin+ Stored XSS via Widget
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exa…
-
Medium 5.9
WP-SVG <= 0.9 - Contributor+ Stored XSS via Shortcode
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-…
-
Medium 4.8CVE-2024-11605 Public exploit
WP Publications <= 1.2 - Admin+ Stored XSS
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is…
-
Medium 6.3
CodeAstro Car Rental System bookingconfirm.php sql injection
A vulnerability was found in CodeAstro Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bookingconfirm.php. The manipulation of the argument driver_id_from_dropdown leads to sql i…
-
Medium 4.3
code-projects Job Recruitment _all_edits.php fln_update cross site scripting
A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to cross site scripting. It is po…
-
Medium 4.3
code-projects Job Recruitment _all_edits.php cn_update cross site scripting
A vulnerability was found in code-projects Job Recruitment 1.0 and classified as problematic. This issue affects the function cn_update of the file /_parse/_all_edits.php. The manipulation of the argument cname leads to cross site scripting. The attack may be…
-
High 7.3
code-projects Job Recruitment _all_edits.php add_req sql injection
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as critical. This vulnerability affects the function add_req of the file /_parse/_all_edits.php. The manipulation of the argument jid/limit leads to sql injection. The attack c…
-
Medium 6.5
Python-sql: python-sql unary operators does not escape non-expression
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
-
Medium 6.3
PHPGurukul Complaint Management System state.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 1.0. This affects an unknown part of the file /admin/state.php. The manipulation of the argument state leads to sql injection. It is possible to initiate th…
-
High 7.3
CodeZips Hospital Management System staff.php sql injection
A vulnerability, which was classified as critical, has been found in CodeZips Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /staff.php. The manipulation of the argument tel leads to sql injection. The attack …
-
Critical 9.8
SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id parame…
-
Critical 9.8
SmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php.
-
Critical 9.8CVE-2024-50944 Public exploit
Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shoppi…
-
Critical 9.8
SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client pa…
-
High 7.5
An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command inj…
-
High 7.5
A Server-Side Request Forgery (SSRF) in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive…
-
High 7.5CVE-2024-50945 Public exploit
An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, al…
-
High 7.5
Letta (previously MemGPT) incorrect access control vulnerability
Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.
-
Medium 5.9CVE-2024-53476 Public exploit
A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to …
-
Medium 4.8
A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0…
-
Medium 5.3
An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.…
-
Medium 4.8
Dcat Admin Cross-site Scripting (XSS) vulnerability
Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.
-
Medium 4.8
Dcat-Admin Cross-Site Scripting (XSS) vulnerability
Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions.
-
Critical 9.4
An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentic…