Export limit exceeded: 23572 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (23572 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-8112 | 1 Jeesite | 1 Jeesite | 2024-09-12 | 4.3 Medium |
| A vulnerability was found in thinkgem JeeSite 5.3. It has been rated as problematic. This issue affects some unknown processing of the file /js/a/login of the component Cookie Handler. The manipulation of the argument skinName leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-8113 | 1 Pretix | 1 Pretix | 2024-09-12 | 5.4 Medium |
| Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users. | ||||
| CVE-2024-42364 | 1 Gethomepage | 1 Homepage | 2024-09-12 | 6.5 Medium |
| Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will ask a user to visit his/her website. The attacker website will then change the DNS records of their domain from their IP address to the internal IP address of the homepage instance. To tell which IP addresses are valid, we can rebind a subdomain to each IP address we want to check, and see if there is a response. Once potential candidates have been found, the attacker can launch the attack by reading the response of the webserver after the IP address has changed. When the attacker domain is fetched, the response will be from the homepage instance, not the attacker website, because the IP address has been changed. Due to a lack of authentication, a user’s private information such as API keys (fixed after first report) and other private information can then be extracted by the attacker website. | ||||
| CVE-2024-44796 | 2 Picuploader Project, Xiebruce | 2 Picuploader, Picuploader | 2024-09-06 | 8 High |
| A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter. | ||||
| CVE-2024-44797 | 1 Gazelle Project | 1 Gazelle | 2024-09-06 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter. | ||||
| CVE-2024-42790 | 2 Kashipara, Lopalopa | 2 Music Management System, Music Management System | 2024-09-05 | 6.1 Medium |
| A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter. | ||||
| CVE-2024-42792 | 2 Kashipara, Lopalopa | 2 Music Management System, Music Management System | 2024-09-05 | 3.5 Low |
| A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. | ||||
| CVE-2024-42906 | 2 Jenkins, Testlink | 2 Testlink, Testlink | 2024-09-05 | 4.1 Medium |
| TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name. | ||||
| CVE-2024-44793 | 1 Gazelle Project | 1 Gazelle | 2024-09-05 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter. | ||||
| CVE-2024-44794 | 2 Picuploader, Xiebruce | 2 Commit, Picuploader | 2024-09-05 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter. | ||||
| CVE-2024-44795 | 1 Gazelle Project | 1 Gazelle | 2024-09-05 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter. | ||||
| CVE-2024-38869 | 1 Zohocorp | 4 Manageengine Endpoint Central, Manageengine Servicedesk Plus, Manageengine Servicedesk Plus Msp and 1 more | 2024-08-30 | 8.3 High |
| Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25. | ||||
| CVE-2022-39996 | 1 Teldat | 4 Rs123, Rs123 Firmware, Rs123w and 1 more | 2024-08-30 | 4.8 Medium |
| Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page. | ||||
| CVE-2024-43915 | 1 Zephyr-one | 1 Zephyr Project Manager | 2024-08-28 | 5.5 Medium |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102. | ||||
| CVE-2024-8172 | 2 Rems, Sourcecodester | 2 Qr Code Attendance System, Qr Code Attendance System | 2024-08-28 | 3.5 Low |
| A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Attendance System 1.0. This issue affects some unknown processing of the file /endpoint/delete-student.php. The manipulation of the argument student/attendance leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-8170 | 2 Rems, Sourcecodester | 2 Zipped Folder Manager App, Zipped Folder Manager App | 2024-08-27 | 3.5 Low |
| A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-43337 | 1 Getbrave | 1 Brave | 2024-08-27 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0. | ||||
| CVE-2024-43339 | 1 Webinarpress | 1 Webinarpress | 2024-08-27 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20. | ||||
| CVE-2024-43340 | 1 Advancedformintegration | 1 Advanced Form Integration | 2024-08-27 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4. | ||||
| CVE-2024-43356 | 1 Bobbingwide | 1 Oik | 2024-08-27 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide.This issue affects oik: from n/a through 4.12.0. | ||||