15397 matches found
PT-2024-26541 · Idccms · Idccms
Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/share switch.php. The affected endpoint includes parameters such as mudi, dataType, fieldName, fieldName2, tabName, and dataID...
ROS-20240522-01
A vulnerability in the CRI-O container mechanism is related to the injection of an arbitrary property via the Pod annotation. systemd. Exploitation of the vulnerability could allow an attacker acting remotely to perform an an arbitrary action on the host system...
Arforms < 6.4.1 - Reflected XSS
Description The plugin does not properly escape user-controlled input when it is reflected in some of its AJAX actions. PoC https://www.example.com/wp-admin/admin-ajax.php?action=currentmodalmodal=...
CentOS 8 : xorg-x11-server-Xwayland (CESA-2024:2996)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:2996 advisory. - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data...
CVE-2021-47293 net/sched: act_skbmod: Skip non-Ethernet packets
In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: Skip non-Ethernet packets Currently tcfskbmodact assumes that packets use Ethernet as their L2 protocol, which is not always the case. As an example, for CAN devices: $ ip link add dev vcan0 type vcan $ ip...
CVE-2023-3942 Multiple SQLi in ZkTeco-based OEM devices
An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the...
Cross-Site Scripting
Cacti is vulnerable to Cross-site Scripting. The vulnerability is due to malicious scripts being permanently stored on a target server and served to users who access a particular page, which attackers can use to execute scripts in the context of the user's browser, potentially leading to...
Mozilla: csrftoken not unique to session or specific user and csrfmiddlewaretoken can be altered
The CSRF token used in the application was not unique to the session or specific user, allowing an attacker to use a valid CSRF token obtained from another user to perform unauthorized actions on behalf of that user...
CVE-2023-3942: Improper Neutralization of Special Elements used in an SQL Command
An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the...
CVE-2024-27312
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...
CVE-2024-27312
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...
CVE-2024-27312 Authorization vulnerability in PAM360
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...
CVE-2024-27312
The CVE-2024-27312 entry concerns Zohocorp ManageEngine PAM360 version 6601, where an authorization vulnerability allows a low-privileged user to perform admin actions. The issue is limited to 6601; other PAM360 versions are not indicated as affected in the provided documents. The root cause is d...
Fastly < 1.2.26 - Missing Authorization via AJAX actions
Description The Fastly plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the plugin's AJAX actions in versions up to, and including, 1.2.25. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
CVE-2024-27312: Incorrect Authorization
Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...
PT-2024-21814 · Zohocorp · Manageengine Pam360
Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine PAM360 version 6601 Description: The issue allows a low-privileged user to perform admin actions due to an authorization vulnerability. Recommendations: For Zohocorp ManageEngine PAM360 version 6601, update to a version...
Clearfy Cache <= 2.2.1 - Cross-Site Request Forgery
Description The Clearfy Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request...
Fast Custom Social Share by CodeBard <= 1.1.2 - Cross-Site Request Forgery
Description The Fast Custom Social Share by CodeBard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions...
GitLab 9.5 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13263)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perfo...