7307 matches found
CVE-2024-1962
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack...
Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Settings Ultimate Noindex" 2...
PT-2024-21877 · Planet · Planet Igs-4215-16T2S
Name of the Vulnerable Software and Affected Versions: Planet IGS-4215-16T2S version 1.305b210528 Description: The issue is related to an information exposure vulnerability. It could allow a remote attacker to access some administrative resources due to the lack of proper management of the Switch...
CVE-2024-2443
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub...
PYSEC-2024-179
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...
PT-2024-22352 · Octoprint · Octoprint
Name of the Vulnerable Software and Affected Versions: OctoPrint versions up to and including 1.9.3 Description: OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows malicious admins to configure or talk a victim with administrator rights into configuring a...
CVE-2024-1654
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...
CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...
CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...
PT-2024-18202
Name of the Vulnerable Software and Affected Versions PaperCut NG versions affected versions not specified Description This issue potentially allows unauthorized write operations, which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of bo...
Exploit for SQL Injection in Abocms Abo.Cms
ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227...
BIT-DISCOURSE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag
Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...
Information disclosure
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process...
PT-2024-21974 · Unknown · Cms Made Simple
Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.19 Description: The issue is a Cross Site Scripting XSS vulnerability that resides in the File Manager module of the admin panel. It arises due to inadequate sanitization of user input in the "New directory" field...
PT-2024-2868 · Cdata +1 · Cdata Connect +1
Name of the Vulnerable Software and Affected Versions: CData Connect versions prior to 23.4.8846 Description: A path traversal vulnerability exists in the Java version of CData Connect when running using the embedded Jetty server. This could allow an unauthenticated remote attacker to gain comple...
CVE-2023-39254
Dell Update Package DUP, Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin...
Cross site request forgery (csrf)
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...
CVE-2024-0689
The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the meta values. This makes it possible for authenticated attackers, with...