An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass network filtering, execute arbitrary code, and obtain sensitive information via DarkLayer Guard threat prevention module. NOTE: Heimdal disputes the validity o...
AFFECTED_PRODUCTS:
Heimdalsecurity Thor,
Heimdalsecurity Thor
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and...
AFFECTED_PRODUCTS:
Hcltech Bigfix Modern Client Management
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the...
AFFECTED_PRODUCTS:
Aiven Journalpump
An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS verification code function to arbitrary phone.
AFFECTED_PRODUCTS:
Ltb-Project Self Service Password
An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ engine.
AFFECTED_PRODUCTS:
Stormshield Stormshield Network Security,
Stormshield Stormshield Network Security,
Stormshield Stormshield Network Security
Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3...
AFFECTED_PRODUCTS:
Grails Grails,
Grails Grails,
Grails Grails
... (+1)
HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion.
AFFECTED_PRODUCTS:
Hcltechsw Hcl Launch,
Hcltechsw Hcl Launch,
Hcltechsw Hcl Launch
... (+1)
An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's possible to know if a specific user account exists on the SNS firewall by using remote access commands.
AFFECTED_PRODUCTS:
Stormshield Stormshield Network Security,
Stormshield Stormshield Network Security,
Stormshield Stormshield Network Security
... (+2)
Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a command injection vulnerability via the function downFiles.
AFFECTED_PRODUCTS:
Ruijie Rg Ws6008 Firmware,
Ruijie Rg Ws6108 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
AFFECTED_PRODUCTS:
Tenda I29 Firmware,
Tenda I29 Firmware
Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page.
AFFECTED_PRODUCTS:
Iscute Cute Http File Server,
Iscute Cute Http File Server
Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the reg_action.php resource does not validate the characters received and they are sent unfiltered to the database.
AFFECTED_PRODUCTS:
Projectworlds Online Voting System Project
Online Voting System Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the login_action.php resource does not validate the characters received and they are sent unfiltered to the database.
AFFECTED_PRODUCTS:
Projectworlds Online Voting System Project
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
AFFECTED_PRODUCTS:
Kashipara Hotel Management
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
AFFECTED_PRODUCTS:
Kashipara Hotel Management
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
AFFECTED_PRODUCTS:
Kashipara Hotel Management
Unrestricted Upload of File with Dangerous Type vulnerability in Zendrop Zendrop – Global Dropshipping.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
AFFECTED_PRODUCTS:
Zendrop Zendrop
Unrestricted Upload of File with Dangerous Type vulnerability in WooRockets Corsa.This issue affects Corsa: from n/a through 1.5.
AFFECTED_PRODUCTS:
Woorockets Corsa
Windows Local Session Manager (LSM) Denial of Service Vulnerability
AFFECTED_PRODUCTS:
Microsoft Windows 11 21h2,
Microsoft Windows 10 20h2,
Microsoft Windows 10 21h1
... (+3)
Unrestricted Upload of File with Dangerous Type vulnerability in Symbiostock symbiostock.This issue affects Symbiostock: from n/a through 6.0.0.
AFFECTED_PRODUCTS:
Symbiostock Symbiostock
SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL commands via the table parameter.
AFFECTED_PRODUCTS:
Cuppacms Cuppacms
Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.
AFFECTED_PRODUCTS:
Themepunch Slider Revolution
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
AFFECTED_PRODUCTS:
Themify Ultra
Unrestricted Upload of File with Dangerous Type vulnerability in Jeff Starr User Submitted Posts – Enable Users to Submit Posts from the Front End.This issue affects User Submitted Posts – Enable Users to Submit Posts from the Front End: from n/a through 20230902.
AFFECTED_PRODUCTS:
Plugin-Planet User Submitted Posts
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
AFFECTED_PRODUCTS:
Premio Folders
Unrestricted Upload of File with Dangerous Type vulnerability in Akshay Menariya Export Import Menus.This issue affects Export Import Menus: from n/a through 1.8.0.
AFFECTED_PRODUCTS:
Akshaymenariya Export Import Menus
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
AFFECTED_PRODUCTS:
Wpchill Download Monitor
Unrestricted Upload of File with Dangerous Type vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.40.
AFFECTED_PRODUCTS:
Woocommerce Automatewoo
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
AFFECTED_PRODUCTS:
Unlimited-Elements Unlimited Elements For Elementor
Unrestricted Upload of File with Dangerous Type vulnerability in AmaderCode Lab Dropshipping & Affiliation with Amazon.This issue affects Dropshipping & Affiliation with Amazon: from n/a through 2.1.2.
AFFECTED_PRODUCTS:
Amadercode Dropshipping \& Affiliation With Amazon
Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.
AFFECTED_PRODUCTS:
Hmplugin Jobwp
Unrestricted Upload of File with Dangerous Type vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
AFFECTED_PRODUCTS:
Olivethemes Olive One Click Demo Import
Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1.
AFFECTED_PRODUCTS:
Themely Theme Demo Import
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spoon themes Adifier - Classified Ads WordPress Theme.This issue affects Adifier - Classified Ads WordPress Theme: from n/a before 3.1.4.
AFFECTED_PRODUCTS:
Spoonthemes Adifier
Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.
AFFECTED_PRODUCTS:
Gvnpatidar Hotel Management System
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
AFFECTED_PRODUCTS:
Magiclogix Msync
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
AFFECTED_PRODUCTS:
Guelbetech Bravo Translate
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.
AFFECTED_PRODUCTS:
Favethemes Houzez
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through...
AFFECTED_PRODUCTS:
Bestwebsoft Contact Form To Db
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress: from n/a thro...
AFFECTED_PRODUCTS:
Pagevisitcounter Advanced Page Visit Counter
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: from n/a through 1.7.6.
AFFECTED_PRODUCTS:
Tribulant Slideshow Gallery
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Ama...
AFFECTED_PRODUCTS:
Wedevs Dokan