CVE-2024-3806 Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts

The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in...

CVE-2024-4441 XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion

The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any P...

CVE-2024-4441 XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion

The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any P...

CVE-2024-4441

CVE-2024-4441 affects the WordPress plugin XML Sitemap & Google News. The vulnerability is Local File Inclusion via the feed parameter in all versions up to 5.4.8, allowing unauthenticated attackers to include and execute arbitrary server-side files (PHP) and potentially bypass access controls or...

CVE-2022-32507

An issue was discovered on certain Nuki Home Solutions devices. Some BLE commands, which should have been designed to be only called from privileged accounts, could also be called from unprivileged accounts. This demonstrates that no access controls were implemented for the different BLE commands...

CVE-2022-32507

An improper access control vulnerability exists in certain Nuki Home Solutions devices, specifically affecting Nuki Smart Lock 3.0 (versions before 3.3.5) and Nuki Smart Lock 2.0 (versions before 2.12.4). The root cause is a lack of access controls for BLE commands , which allows unprivileged acc...

CVE-2024-29210

CVE-2024-29210 describes a local privilege escalation in Phish Alert Button for Outlook (PAB) caused by insecure permissions on the configuration file (update server URL). An unprivileged local user can modify the configuration to point updates to a malicious server, enabling LPE in conjunction w...

XML Sitemap & Google News < 5.4.9 - Unauthenticated Local File Inclusion

Description The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...

Access Control Bypass

github.com/pterodactyl/wings is vulnerable to Access Control Bypass. The vulnerability is due to improper access controls within the pull endpoint, allowing authenticated users to evade restrictions and potentially access resources on local networks...

CVE-2024-3849 Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusion

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution ...

CVE-2024-3849

CVE-2024-3849 concerns the Click to Chat – HoliThemes WordPress plugin (up to 3.35). The issue is Local File Inclusion, allowing authenticated users with contributor+ rights to include/execute PHP files on the server, bypassing some access controls and potentially leading to code execution. Affec...

CVE-2024-3499

The CVE-2024-3499 entry concerns ElementsKit Elementor addons and Templates Library for WordPress. Impact arises from a Local File Inclusion in the Onepage Scroll module’s generate_navigation_markup function, enabling an authenticated attacker with contributor+ privileges to include and execute a...

Veritas Backup Exec Remote Agent 21.0.x, 21.1.x, 21,2.x, 21,3.x, 21.4.x, 22.0.x, 22.1.x, 22.2.x Multiple Vulnerabilities

The version of Vertias Backup Exec Remote Agent installed on the remote Windows host is 21.0.x, 21.1.x, 21,2.x, 21,3.x, 21.4.x, 22.0.x, 22.1.x or 22.2.x prior to 22.2 HotFix 917391. It is therefore affectewd by multiple vulnerabilities: - An issue was discovered in Veritas Backup Exec before 22.2...

PT-2024-20077 · Quest · Quest Kace Agent For Windows

Name of the Vulnerable Software and Affected Versions: Quest KACE Agent for Windows versions 12.0.38 through 13.1.23.0 Description: An issue exists in the KSchedulerSvc.exe component, allowing local attackers to delete any file of their choice with NT AuthoritySYSTEM privileges. This is due to an...

CVE-2024-33673

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path...

CVE-2024-33673

CVE-2024-33673 affects Veritas Backup Exec before 22.2 HotFix 917391. The issue is improper access controls that enable DLL hijacking in the Windows DLL search path. CVSS v3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW attack complexity, and privileges required, no user interaction. Impa...

CVE-2024-33673

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search path...

PT-2024-13926 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An incorrect authorization issue has been reported, affecting several QNAP operating system versions. If exploited,...

Privilege Escalation

github.com/kubevirt/kubevirt/ is vulnerable to Privilege Escalation. This vulnerability arises due to insufficient access controls, enabling an attacker to assume the privileges of the VM process on the host system. Consequently, attackers could potentially read and modify any file on the system...

PT-2024-14141 · Unknown · Eazy Plugin Manager

Name of the Vulnerable Software and Affected Versions: Eazy Plugin Manager versions n/a through 4.1.2 Description: The issue is related to an Improper Authentication vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions n/a through...