Synology Drive 安全漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A security vulnerability exists in Synology Drive before 3.4.0-15721, which stems from the presence of a buffe...

Synology Drive 安全漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A security vulnerability exists in Synology Drive before 3.4.0-15721, which stems from the presence of a buffe...

CVE-2024-8791

The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied...

CVE-2024-8791

CVE-2024-8791 affects Charitable – Donation Plugin for WordPress (versions

CVE-2024-8853 Webo-facto <= 1.40 - Unauthenticated Privilege Escalation

The Webo-facto plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.40 due to insufficient restriction on the 'doSsoAuthentification' function. This makes it possible for unauthenticated attackers to make themselves administrators by registering with a...

CVE-2024-8853

Vulnerability summary (CVE-2024-8853) The Webo-facto plugin for WordPress is affected in versions up to and including 1.40. The root cause is an insufficient restriction on the doSsoAuthentification function, enabling unauthenticated attackers to escalate privileges by registering with a username...

CVE-2024-37879

Improper input validation in /admin/config/save in User-friendly SVN USVN before v1.0.12 and below allows administrators to execute arbitrary code via the fields "siteTitle", "siteIco" and "siteLogo"...

CVE-2024-8969

The CVE-2024-8969 entry concerns OMFLOW by The SYSCOM Group. Affected software/component: OMFLOW; root cause/issue: exposure of password hashes of all users and administrators. Exploitation details in the source documents indicate remote attackers who have logged into the system can obtain these ...

CVE-2024-8969 The SYSCOM Group OMFLOW - Exposure of Sensitive Data

OMFLOW from The SYSCOM Group has a vulnerability involving the exposure of sensitive data. This allows remote attackers who have logged into the system to obtain password hashes of all users and administrators...

Concrete CMS 安全漏洞

Concrete CMS is a team-oriented open source content management system from Concrete CMS Open Source. A security vulnerability exists in Concrete CMS versions 9.0.0 through 9.3.3, which stems from improper output cleanup, resulting in a malicious administrator being able to add a malicious load th...

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Impact The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. Patches N/A Workarounds Review the user accounts tha...

CVE-2024-6019

The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators...

CVE-2024-6019 Music Request Manager <= 1.3 - Unauthenticated Stored XSS

The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators...

CVE-2024-6019 Music Request Manager <= 1.3 - Unauthenticated Stored XSS

The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators...

CVE-2024-8688

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface CLI enables authenticated administrators including read-only administrators with access to the CLI to to read arbitrary files on the firewall...

CVE-2024-8688 PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface CLI enables authenticated administrators including read-only administrators with access to the CLI to to read arbitrary files on the firewall...

CVE-2024-8688

CVE-2024-8688: A local, authenticated-admin vulnerability in Palo Alto Networks PAN-OS CLI allows reading arbitrary files on the firewall via improper neutralization of matching symbols. Affected PAN-OS versions include PAN-OS 9.1.x before 9.1.15, 10.0.x before 10.0.10, and 10.1.x before 10.1.1 (...

PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)

An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface CLI enables authenticated administrators including read-only administrators with access to the CLI to to read arbitrary files on the firewall. Work around: No work around available...

Palo Alto Networks PAN-OS 9.1.x < 9.1.15 / 10.0.x < 10.0.10 / 10.1.x < 10.1.1 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 9.1.x prior to 9.1.15 or 10.0.x prior to 10.0.10 or 10.1.x prior to 10.1.1. It is, therefore, affected by a vulnerability. An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command...

CVE-2023-2919 Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addonenabledisable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a...