Archive
9 January 2025
Vulnerabilities first published on this day (UTC), newest first.
267 results · Feed
-
Medium 5.3
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability
There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
-
Medium 5.3
Possible Denial of Service Vulnerability in Rack's header parsing
There is a denial of service vulnerability in the header parsing component of Rack.
-
Medium 6.3
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clip…
-
High 8.1
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line …
-
Low 3.6
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be igno…
-
Low 3.5
langhsu Mblog Blog System Search Bar search cross site scripting
A vulnerability classified as problematic was found in langhsu Mblog Blog System 3.5.0. Affected by this vulnerability is an unknown functionality of the file /search of the component Search Bar. The manipulation of the argument kw leads to cross site scripti…
-
Low 3.7
langhsu Mblog Blog System login observable response discrepancy
A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulation leads to observable response discrepancy. It is possible to launch the attack remotely. The compl…
-
Low 3.5
donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting
A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/main/Java/org/zdd/bookstore/web/controller/admin/AdminUserControlle.java. The manipulation leads to cr…
-
Low 3.5
donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting
A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of the file src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. The manipulation of…
-
Critical 9.8CVE-2023-28354 Public exploit
An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against af…
-
Critical 9.8
Vaultwarden vulnerable to user impersonation
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
-
Critical 9.6
Vaultwarden HTML injection vulnerability
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
-
Medium 5.4
Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability
Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.
-
Medium 6.1
A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call…
-
Medium 6.8
Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate p…
-
High 7.8
In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulate…
-
Critical 9.1
Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or…
-
High 8.8
Cross Site Scripting vulnerability in LinZhaoguan pb-cms v.2.0 allows a remote attacker to execute arbitrary code via t…
-
Medium 6.3
Ruoyi v.4.7.9 and before contains an authenticated SQL injection vulnerability. This is because the filterKeyword metho…
-
Critical 9.8
PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusi…
-
High 8.0CVE-2024-54887 Public exploit
TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver…
-
Medium 6.3CVE-2024-54761 Public exploit
BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
-
High 7.5
Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information…
-
Medium 6.5
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit …
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users…
-
Medium 5.4
A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to injec…