CVE-2024-7919

CVE-2024-7919 affects Anhui Deshun Intelligent Technology’s Jieshun JieLink+ JSOTC2016 up to 20240805. The issue arises in the processing of the file /report/ParkChargeRecord/GetDataList, causing improper access controls. An attacker may exploit this remotely; the vulnerability has been disclosed...

PT-2024-38688 · Anhui Deshun Intelligent Technology · Jielink+ Jsotc2016

Name of the Vulnerable Software and Affected Versions: Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 Description: A vulnerability has been found in the software, classified as problematic, and affects an unknown functionality of the file...

CVE-2024-7145

CVE-2024-7145 : JetElements (WordPress) is vulnerable to authenticated Local File Inclusion via the progress_type parameter in versions up to 2.6.20. Exploitation allows an authenticated attacker (Contributor+ level) to include and execute arbitrary PHP files on the server, bypassing some access ...

CVE-2024-7146

The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcherpreset' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...

CVE-2024-7146

CVE-2024-7146 affects JetTabs for Elementor (WordPress plugin) up to v2.2.3. It allows authenticated users with Contributor-level access and above to perform Local File Inclusion via the switcher_preset parameter, enabling inclusion/ execution of arbitrary PHP code on the server and potentially b...

WordPress Profilepro 1.3 Cross Site Scripting Vulnerability

Exploit Title: profilepro if !response.ok throw new Error'Network response was not ok'; return response.text; .thendata = console.logdata .catcherror = console.error'Error:', error; - As an admin, go to http://example.com/wp-admin/edit.php?posttype=profileproform - Choose the default profile, cli...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

CVE-2021-26387

CVE-2021-26387 describes insufficient access controls in the AMD ASP kernel that could allow a privileged attacker with access to AMD signing keys and BIOS/UEFI shell to map DRAM regions into protected areas, risking platform integrity. Public documents indicate this CVE is tracked within AMD sec...

CVE-2021-26387

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...

Improper Access Control

Apache DolphinScheduler is vulnerable to Improper Access Control. The vulnerability is due to there is no proper validation on access controls that allowing authenticated users to illegally access additional resource files...

PT-2024-28193 · Unknown · Olive One Click Demo Import

Name of the Vulnerable Software and Affected Versions: Olive One Click Demo Import versions 1.1.2 and earlier Description: The issue allows exposure of sensitive information to an unauthorized actor due to accessing functionality not properly constrained by ACLs. Recommendations: For Olive One...

WordPress Profilepro 1.3 Cross Site Scripting

Exploit Title: profilepro if !response.ok throw new Error'Network response was not ok'; return response.text; .thendata = console.logdata .catcherror = console.error'Error:', error; - As an admin, go to http://example.com/wp-admin/edit.php?posttype=profileproform - Choose the default profile, cli...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

CVE-2024-41912

Poly Clariti Manager firmware builds up to 10.10.2.2 are affected by a flaw that fails to properly enforce access controls, potentially enabling unauthorized access. Affected product/versions: Poly Clariti Manager devices up to 10.10.2.2. Root cause: firmware-level access-control flaw (per multip...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

CVE-2024-41912

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly implement access controls...

PT-2024-29322 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An Incorrect Access Control issue was found in the /smsa/view class.php endpoint, allowing remote unauthenticated attackers to view class details. This could lead to...

Vestaboard: Exploring Broken Access Controls and Privilege Escalation

The post Vestaboard: Exploring Broken Access Controls and Privilege Escalation appeared first on Rhino Security Labs...

CVE-2024-5709 WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion

The WPBakery Visual Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.7 via the 'layoutname' parameter. This makes it possible for authenticated attackers, with Author-level access and above, and with post permissions granted by an...