CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848...

CVE-2024-13158

An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution...

Ivanti EPM 安全漏洞

Ivanti EPM is a comprehensive endpoint management solution developed by Ivanti. Ivanti EPM suffers from a code execution vulnerability that stems from the inclusion of an unrestricted resource search path. An attacker could exploit this vulnerability to achieve remote code execution...

PT-2025-1129 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to the 2024 January-2025 Security Update Ivanti EPM versions prior to the 2022 SU6 January-2025 Security Update Description: An unbounded resource search path exists in Ivanti EPM. Exploitation of this issue may allo...

PT-2025-1294 · Unknown · Stealthone D220 +2

Name of the Vulnerable Software and Affected Versions: STEALTHONE D220/D340/D440 affected versions not specified Description: A user with administrative privileges who logs in to the web management page of the affected product may execute an arbitrary OS command. The vulnerability is related to t...

WordPress WP All Import Pro plugin <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import vulnerability

Authenticated Administrator+ Server-Side Request Forgery via File Import vulnerability discovered by Ivan Kuzymchak in WordPress Plugin WP All Import Pro versions = 4.9.3...

CVE-2024-55550

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access...

CVE-2024-47579

An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows th...

SAP Adobe Document Service 安全漏洞

SAP Adobe Document Service SAP ADS is a document management service from SAP, Germany. A security vulnerability exists in SAP Adobe Document Service, which originates from an attacker authenticated as an administrator, who can create PDFs with embedded attachments using publicly available Web...

PT-2024-9338 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java affected versions not specified Description: The issue allows an attacker, authenticated as an administrator, to use an exposed webservice to upload or download a custom PDF font file on the system server. By...

Mitel MiCollab 安全漏洞

Mitel MiCollab is a mobile application that provides voice, video, messaging, audio conferencing, and team collaboration for employees from Mitel Canada. A security vulnerability exists in Mitel MiCollab that stems from insufficient input cleanup. An authenticated attacker with administrator...

CVE-2024-53282

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...

CVE-2024-53279

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in file station functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensiti...

WordPress FileOrganizer plugin <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion vulnerability

Authenticated Administrator+ Local JavaScript File Inclusion vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin FileOrganizer versions = 1.1.4...

Aginode GigaSwitch 安全漏洞

Aginode GigaSwitch is a LANactive support portal from Aginode. A security vulnerability exists in Aginode GigaSwitch V5 prior to version 7.06G, which stems from allowing an authenticated attacker with administrator privileges to upload an earlier version of firmware, thereby exposing the device t...

WordPress File Manager Pro – Filester plugin <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion vulnerability

Authenticated Administrator+ Local JavaScript File Inclusion vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Pro versions = 1.8.5...

PT-2024-39751

Name of the Vulnerable Software and Affected Versions File Manager Pro – Filester plugin for WordPress versions up to, and including, 1.8.5 Description The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion via the fm locale parameter. This allows...

WordPress Total Upkeep plugin <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings vulnerability

Authenticated Administrator+ Remote Code Execution via Backup Settings vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Total Upkeep versions = 1.16.6...

CVE-2024-52052

CVE-2024-52052 affects Wowza Streaming Engine prior to 4.9.1, with the vulnerability rooted in insufficient input validation in the Manager web dashboard. An authenticated Streaming Engine Manager administrator can define a custom application property and poison a stream target, enabling high-pri...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14 / 10.2.x < 10.2.11 / 11.0.x < 11.0.6 / 11.1.x < 11.1.4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14 or 10.2.x prior to 10.2.11 or 11.0.x prior to 11.0.6 or 11.1.x prior to 11.1.4. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS...