Filtered by vendor Subscriptions
Total 322438 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-9895 1 Zaytech 1 Smart Online Order For Clover 2024-10-17 6.4 Medium
The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo_receipt_link shortcode in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-9944 2 Woocommerce, Woothemes 2 Woocommerce, Woocommerce 2024-10-17 5.3 Medium
The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions.
CVE-2024-21535 2 Markdown-to-jsx, Quantizor 2 Markdown-to-jsx, Markdown-to-jsx 2024-10-17 6.1 Medium
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can execute arbitrary code by injecting a malicious iframe element in the markdown.
CVE-2024-9971 2 New Type, Newtype 2 Flowmaster Bpm Plus, Flowmaster Bpm Plus 2024-10-17 8.8 High
The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents.
CVE-2024-9970 2 New Type, Newtype 2 Flowmaster Bpm Plus, Flowmaster Bpm Plus 2024-10-17 8.8 High
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie.
CVE-2024-45711 1 Solarwinds 1 Serv-u 2024-10-17 7.5 High
SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. This issue requires a user to be authenticated and this is present when software environment variables are abused. Authentication is required for this vulnerability
CVE-2024-9905 2 Oretnom23, Sourcecodester 2 Online Eyewear Shop, Online Eyewear Shop 2024-10-17 6.3 Medium
A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-8530 1 Schneider-electric 1 Data Center Expert 2024-10-17 5.9 Medium
CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generated “logcaptures” archive is accessed directly by HTTPS.
CVE-2024-20521 1 Cisco 8 Rv042, Rv042 Firmware, Rv042g and 5 more 2024-10-17 6.5 Medium
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid Administrator credentials on the affected device.   This vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system as the root user.
CVE-2024-4089 1 Lenovo 1 Superfile 2024-10-17 7.8 High
A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.
CVE-2024-4130 1 Lenovo 1 App Store 2024-10-17 7.8 High
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
CVE-2024-4131 1 Lenovo 1 Emulator 2024-10-17 7.8 High
A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.
CVE-2024-4132 1 Lenovo 1 Lock Screen 2024-10-17 7.8 High
A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.
CVE-2024-9046 1 Lenovo 1 Starstudio 2024-10-17 7.8 High
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
CVE-2024-48251 1 Wavelog 1 Wavelog 2024-10-17 7.3 High
Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
CVE-2024-8918 1 Filemanagerpro 2 File Manager, File Manager Pro 2024-10-17 7.4 High
The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This is due to a lack of proper checks on allowed file types. This makes it possible for unauthenticated attackers, with permissions granted by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
CVE-2024-8746 1 Filemanagerpro 2 File Manager, File Manager Pro 2024-10-17 7.5 High
The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible.
CVE-2024-8507 1 Filemanagerpro 1 File Manager 2024-10-17 8.8 High
The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-47130 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 8.8 High
The goTenna Pro App allows unauthenticated attackers to remotely update the local public keys used for P2P and group messages. It is advised to update your app to the current release for enhanced encryption protocols.
CVE-2024-47129 1 Gotenna 2 Gotenna Pro, Pro App 2024-10-17 4.3 Medium
The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.