18057 matches found
CVE-2024-34539
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...
CVE-2024-34539
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...
Popup Builder < 4.3.2 - Missing Authorization in Multiple AJAX Actions
Description The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform multiple unauthorize...
CVE-2024-34539
Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...
CVE-2024-34539
TerraMaster TOS firmware (versions through 5.1 ) contains hardcoded credentials that allow a remote attacker to gain unauthorized access to the mail or webmail server. These credentials can further be used to log into the administration panel to perform privileged actions . To remediate this, use...
The vulnerability of the Hazelcast data analysis platform, related to permission processing errors, allows attackers to perform arbitrary actions.
The vulnerability of the Hazelcast data analysis platform is related to permission processing errors. Exploiting this vulnerability allows a remote attacker to perform arbitrary actions...
CVE-2024-37131
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy CORP vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated use...
CVE-2024-28967
Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API if enabled by Admin user from UI. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain API...
CVE-2024-37131
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy CORP vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated use...
CVE-2024-37131
The CVE-2024-37131 affects Dell SCG/Policy Manager across versions, due to an overly permissive Cross-Origin Resource Policy (CORP). A remote, unauthenticated attacker could perform actions in an authenticated user’s context. Public details confirm the vulnerability and its impact; remediation is...
NVIDIA vGPU Software Security Vulnerability
NVIDIA vGPU Software is a management software from NVIDIA, USA, used to provide GPU capabilities to virtual machines. The software supports multiple virtual machines to access the host's GPU, providing graphics performance and application compatibility for virtual machines. A security vulnerabili...
Dell Secure Connect Gateway Security Vulnerability
Dell Secure Connect Gateway is a secure connectivity gateway from Dell USA. A security vulnerability exists in Dell Secure Connect Gateway that originates from allowing a remote, unauthenticated attacker to perform malicious actions on applications in an authenticated user's environment...
CVE-2024-37131: Permissive Cross-domain Policy with Untrusted Domains
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy CORP vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated use...
CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
CVE-2024-5203
CVE-2024-5203 is described in IBM’s bulletin as a cross-site request forgery in Keycloak used by IBM i Modernization Engine for Lifecycle Integration. It allows a remote authenticated attacker to exploit improper input validation to send a crafted request to /login-actions/authenticate, potential...
CVE-2024-0427
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions...
CVE-2024-0427: Improper Neutralization of Input During Web Page Generation
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions...
PT-2024-13515
Name of the Vulnerable Software and Affected Versions Grab & Save versions 1.0.0 through 1.0.4 Description The issue is a Cross-Site Request Forgery CSRF vulnerability. This means that an attacker can trick a user into performing unintended actions on a web application that the user is...
GHSA-2CWW-FGMG-4JQC Keycloak's admin API allows low privilege users to use administrative functions
Users with low privileges just plain users in the realm are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data...
