CVE-2019-20458: Incorrect Default Permissions

An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes and functions without a password. The user is at no point prompted to set up a password on the device leaving a number of devices without a password. In this case, anyone connecting to the we...

PT-2024-8000 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue is related to a lack of password recovery mechanism in the GLPI system, which can be exploited by a remote attacker to bypass existing security restrictions. An administrator with acce...

PT-2024-15984 · WordPress · Wp Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Booking Calendar WordPress plugin versions prior to 10.6.3 Description: The issue concerns the WP Booking Calendar WordPress plugin, which does not properly sanitise and escape some of its Widgets settings. This could allow high-privilege...

Enel X Waybox security vulnerabilities

Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox that stems from a web management application that can be used to execute arbitrary operating system commands and provide administrator privileges to the Waybox system...

Exploit for CVE-2024-50475

CVE-2024-50475 Signup Page = 1.0 - Unauthenticated Arbitra...

PT-2024-39909 · WordPress · Pods

Name of the Vulnerable Software and Affected Versions: The Pods WordPress plugin versions prior to 3.2.7.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

CVE-2024-8934

Beckhoff TwinCAT Package Manager is affected by a local command injection vulnerability. A local user with administrative rights can enter specially crafted values in the UI to cause arbitrary OS commands to execute. The vulnerability is associated with TwinCAT Package Manager versions prior to 1...

CVE-2024-28875

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be...

PT-2024-7559 · D Link · D-Link Dsl-6740C

Name of the Vulnerable Software and Affected Versions: D-Link DSL-6740C version 6.TR069.20211230 Description: The issue is related to the use of weak password requirements in the D-Link DSL-6740C router's software component. This could allow a remote attacker to escalate their privileges. The...

CVE-2024-9475

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the orderby parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2024-46902

A vulnerability in Trend Micro Deep Discovery Inspector DDI versions 5.8 and above could allow an attacker to disclose sensitive information affected installations. Please note: an attacker must first obtain the ability to execute high-privileged code admin user rights on the target system in ord...

CVE-2024-40087

Vilo 5 Mesh WiFi System = 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router...

PT-2024-28775 · Unknown · Vilo 5 Mesh Wifi System

Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions 5.16.1.33 and earlier Description: The issue is related to Insecure Permissions, specifically a lack of authentication in the custom TCP service on port 5432. This allows remote, unauthenticated attackers to...

CVE-2024-20420

A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. This vulnerability is due to incorrect authorization verification by the HTTP server...

CVE-2024-9582

The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Appointment Booking Calendar plugin <= - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...

PT-2024-31652 · Apache · Apache Cloudstack

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.7.0 through 4.18.2.3 Apache CloudStack versions 4.19.0.0 through 4.19.1.1 Description: The CloudStack Quota feature, which is disabled by default, allows cloud administrators to implement a quota or usage limit...

PT-2024-39699

Name of the Vulnerable Software and Affected Versions Accordion Slider plugin for WordPress versions up to, and including, 1.9.11 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the html attribute of an accordion slider...

VulnCheck KEV: CVE-2020-36832

The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user...

CVE-2024-9953

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...