128 matches found
Microsoft Azure CycleCloud 访问控制错误漏洞
Microsoft Azure CycleCloud is a suite of enterprise-friendly tools from Microsoft Corporation USA for orchestrating and managing high-performance computing HPC environments on Azure. An access control error vulnerability exists in Microsoft Azure CycleCloud. An attacker exploiting this...
CVE-2024-0520 Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command 'Command Injection' within the mlflow.data.httpdatasetsource.py module. Specifically, when loading a dataset from a source URL with an HTTP...
Oracle MySQL Server 8.x <= 8.0.35, 8.1.x <= 8.2.0 Security Update (cpuapr2024) - Linux
Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...
Incorrect Authorization
Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Incorrect Authorization in the User and Organizations section of the Control Panel. An attacker can gain unauthorized ability to modify their own permissions by...
QEMU Security Vulnerabilities
QEMU Quick Emulator is a set of simulation processor software by Fabrice Bellard, a French individual developer. The software is fast and cross-platform. A security vulnerability exists in QEMU versions 7.1.0 through 8.2.1, which stems from the presence of a buffer overflow issue...
PT-2024-13872 · Pegasystems · Pega Platform
Name of the Vulnerable Software and Affected Versions: Pega Platform versions 8.2.1 to Infinity 23.1.0 Description: The issue is related to generated PDFs, which could expose file contents. Recommendations: For Pega Platform versions 8.2.1 to Infinity 23.1.0, at the moment, there is no informatio...
CVE-2024-0665
The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-6741 WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address...
WordPress plugin WP Customer Area security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2024-15071 · WordPress · Wp Customer Area
Name of the Vulnerable Software and Affected Versions: WP Customer Area WordPress plugin versions prior to 8.2.1 Description: The issue arises from the plugin not properly validating users' capabilities in some of its AJAX actions. This allows malicious users to edit other users' account addresse...
Online Eyewear Shop 1.0 SQL Injection Vulnerability
Exploit Title: Online Eyewear Shop 1.0 - Product detail 'id' SQL Injection Unauthenticated Exploit Author: Muhammad Navaid Zafar Ansari Vendor Homepage: https://www.sourcecodester.com/php/16089/online-eyewear-shop-website-using-php-and-mysql-free-download.html Software Link:...
Embedthis Software Appweb Community Edition Denial of Service Vulnerability
Embedthis Software Appweb is a web server for embedded applications from Embedthis Software, Inc. A denial of service vulnerability exists in Embedthis Software Appweb Community Edition version 8.2.1, which originates in src/ http/http/httpLib.c, an attacker can use this vulnerability to crash th...
GHSA-WH6W-69XC-5RQ5 Improper Check for Unusual or Exceptional Conditions in Elasticsearch
A Denial of Service flaw was discovered in Elasticsearch 8.0.0 through 8.2.0. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request. Version 8.2.1 contains a patch...
CVE-2021-31559
A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...
[SECURITY] Fedora 36 Update: proj-8.2.1-6.fc36
Proj and invproj perform respective forward and inverse transformation of cartographic data to or from cartesian data with a wide range of selectable projection functions...
RosarioSIS cross-site scripting vulnerability (CNVD-2023-74437)
RosarioSis is a student information system. It is used to manage students, create reports and make the right decisions. A cross-site scripting vulnerability exists in RosarioSIS version 8.2.1, which stems from a lack of data validation filtering on user-supplied data and output. An attacker can...
RosarioSIS XSS Vulnerability
Reflected Cross-site scripting XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the searchterm parameter in the modules/Scheduling/Courses.php script...
CVE-2021-45416
Reflected Cross-site scripting XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the searchterm parameter in the modules/Scheduling/Courses.php script...
RosarioSis 跨站脚本漏洞
RosarioSis is a student information system. It is used to manage students, create reports and make the right decisions. A cross-site scripting vulnerability exists in RosarioSIS version 8.2.1, which stems from a lack of data validation filtering on user-supplied data and output. An attacker can...