1541
|
6.1 |
MEDIUM
Network
|
amcharts
|
amcharts\
|
The amCharts: Charts and Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'amcharts_javascript' parameter in all versions up to, and including, 1.4.4 due to the abili…
|
CWE-79
Cross-site Scripting
|
CVE-2024-8622
|
2024-09-26 23:59 |
2024-09-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1542
|
8.1 |
HIGH
Network
|
strapi
|
strapi
|
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before ve…
|
CWE-601 CWE-294
Open Redirect Authentication Bypass by Capture-replay
|
CVE-2024-34065
|
2024-09-26 23:55 |
2024-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1543
|
6.5 |
MEDIUM
Network
|
strapi
|
strapi
|
Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, a…
|
NVD-CWE-Other
|
CVE-2024-31217
|
2024-09-26 23:53 |
2024-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1544
|
5.9 |
MEDIUM
Network
|
fortinet
|
forticlient
|
An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiCl…
|
CWE-295
Improper Certificate Validation
|
CVE-2022-45856
|
2024-09-26 23:48 |
2024-09-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1545
|
3.5 |
LOW
Network
|
strapi
|
strapi
|
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this …
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2024-29181
|
2024-09-26 23:48 |
2024-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1546
|
7.5 |
HIGH
Network
|
redhat
|
quay
|
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the…
|
NVD-CWE-Other
|
CVE-2024-5891
|
2024-09-26 23:45 |
2024-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1547
|
9.8 |
CRITICAL
Network
villatheme
|
woocommerce_photo_reviews
|
The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating wha…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2024-8277
|
2024-09-26 23:39 |
2024-09-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
1548
|
5.4 |
MEDIUM
Network
|
elementor
|
website_builder
|
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and in…
|
CWE-79
Cross-site Scripting
|
CVE-2024-5416
|
2024-09-26 23:37 |
2024-09-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1549
|
- |
|
-
|
-
|
Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection. This allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the …
|
-
|
CVE-2024-44678
|
2024-09-26 23:35 |
2024-09-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
1550
|
- |
|
-
|
-
|
An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String() function in the src/core/aws-utils.adb module.
|
-
|
CVE-2024-41708
|
2024-09-26 23:35 |
2024-09-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|