Archive
29 January 2025
Vulnerabilities first published on this day (UTC), newest first.
73 results · Feed
-
High 7.5
Out-of-bounds Write Vulnerability
Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability co…
-
High 7.2
Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter
The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization…
-
High 7.1CVE-2024-12749 Scanner template
Competition Form <= 2.0 - Reflected XSS
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
-
Medium 6.4
ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via link titles in all versions up to, and including, 2.4.1 due to insufficient input sanitizati…
-
Medium 4.3
code-projects Job Recruitment _call_job_search_ajax.php cross site scripting
A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_job_search_ajax.php. The manipulation of the argument job_type leads to cross site scripting. The at…
-
High 7.3
Codezips Gym Management System submit_plan_new.php sql injection
A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/admin/submit_plan_new.php. The manipulation of the argument planid leads to sq…
-
High 7.3
SourceCodester Best Employee Management System Administrative Endpoint View_user.php access control
A vulnerability classified as critical was found in SourceCodester Best Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/View_user.php of the component Administrative Endpoint. The manipulation lead…
-
Medium 6.1
The old versions of EXIF Viewer Classic contain a cross-site scripting vulnerability caused by improper handling of EXI…
-
Low 2.4
SourceCodester Online Courseware Edit Teacher saveeditt.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/saveeditt.php of the component Edit Teacher. The manipulation of the argument fname leads to cross site s…
-
High 8.1
MicroWorld eScan Antivirus Quarantine rtscanner os command injection
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The a…
-
Medium 4.4
IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0.2 Identity Manager uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
-
Low 3.3
MicroWorld eScan Antivirus Quarantine Microworld default permission
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the file /var/Microworld/ of the component Quarantine Handler. The manipulation leads to incorrect default…
-
Low 3.5
ESAFENET CDG todolistjump.jsp cross site scripting
A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulation of the argument flowId leads to cross site scripting. It is possible to initiate the attack remot…
-
Low 3.5
ESAFENET CDG todoDetail.jsp cross site scripting
A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. The manipulation of the argument curpage leads to cross site scripting. The attack may be launched re…
-
Medium 6.3
ESAFENET CDG todoDetail.jsp sql injection
A vulnerability has been found in ESAFENET CDG V5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /todoDetail.jsp. The manipulation of the argument flowId leads to sql injection. The attack can be launched re…
-
Medium 6.3
ESAFENET CDG sdTodoDetail.jsp sql injection
A vulnerability, which was classified as critical, was found in ESAFENET CDG V5. Affected is an unknown function of the file /sdTodoDetail.jsp. The manipulation of the argument flowId leads to sql injection. It is possible to launch the attack remotely. The e…
-
Medium 5.9
IBM Security Verify Governance information
IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middle techniques.
-
High 8.8
Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaSc…
-
Medium 5.4
RuoYi has insecure permissions
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
-
None 0.0
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a p…
-
High 7.8
Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to e…
-
Medium 6.5
A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4.
-
Medium 6.5
RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.
-
Medium 4.9
RuoYi vulnerable to Denial of Service by attackers with admin privileges
An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.
-
Critical 9.8
JFinalCMS 1.0 is vulnerable to SQL Injection in rc/main/java/com/cms/entity/Content.java. The cause of the vulnerabilit…
-
Critical 9.8
Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privile…
-
High 7.8
Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to e…
-
High 7.2
RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring
RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.
-
High 7.5CVE-2024-23733 Public exploit
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Cor…
-
Medium 6.1
HTML Injection vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary HTML …
-
Critical 9.8
When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulner…
-
High 8.8
Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.
-
High 8.0
An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tena…