Aggregator

A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file /productsadd.php. The manipulation of the argument id leads to sql injection. This vulnerability is uniquely identified as CVE-2024-10752. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The initial researcher advisory mentions contradicting file names to be affected.

A vulnerability was found in Codezips ISP Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file pay.php. The manipulation of the argument customer leads to sql injection. This vulnerability is handled as CVE-2024-10751. The attack may be launched remotely. Furthermore, there is an exploit available.

Следователи нашли зацепку в деле, но допрашивать подозреваемого не стали.

Submit #436327 / VDB-282009

Submit #436316 / VDB-282921

Submit #436296 / VDB-282920

A vulnerability classified as problematic was found in ECTOOLS Onlineshop up to 1.0. Affected by this vulnerability is an unknown functionality of the file cart.cgi. The manipulation leads to basic cross site scripting. This vulnerability is known as CVE-2005-4291. The attack can be launched remotely. Furthermore, there is an exploit available.

# CVE-2024-48360 | Qualitor <= v8.24 Unauthenticated SSRF## DescriptionQualitor is a platform fo

XLibre project security advisory---------------------------------As Xlibre Xnest is based on Xorg

# Exploit Title: SmartAgent v1.1.0 - Unauthenticated Remote Code Execution# Date: 01-10-2024# Expl

# Exploit Title: SmartAgent v1.1.0 - Server-Side Request Forgery (SSRF)# Date: 01-10-2024# Exploit

SmartAgent 1.1.0 SQL Injection# Exploit Title: SmartAgent v1.1.0 - Unauthenticated SQL Injection (

A vulnerability has been found in Tenda i22 1.0.0.3(4687) and classified as problematic. Affected by this vulnerability is the function websReadEvent of the file /goform/GetIPTV?fgHPOST/goform/SysToo. The manipulation of the argument Content-Length leads to null pointer dereference. This vulnerability is known as CVE-2024-10750. The attack can be launched remotely. Furthermore, there is an exploit available.

Submit #435407 / VDB-282919

Submit #435261 / VDB-282667

Невинный клик превращается в инструмент для массового сбора данных.

A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67. Affected is the function script of the file /app/admin/controller/api/Plugs.php. The manipulation of the argument uptoken leads to deserialization. This vulnerability is traded as CVE-2024-10749. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in Apple iOS up to 12.3.2. This vulnerability affects unknown code of the component Foundation. The manipulation leads to out-of-bounds read. This vulnerability was named CVE-2019-8641. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Submit #432436 / VDB-282918

A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. This issue affects some unknown processing of the file gr/desquared/kmmsharedmodule/db/RealmDB.java of the component Realm Database Handler. The manipulation of the argument defaultRealmKey leads to use of default cryptographic key. The identification of this vulnerability is CVE-2024-10748. Local access is required to approach this attack. There is no exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.