CVE-2024-8686

CVE-2024-8686 affects Palo Alto Networks PAN-OS software. A command-injection vulnerability allows an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall. Documentation consistently describes the issue as exploitable by an authenticated adm...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS, which originates from a command injection and could allow an authenticated administrator to bypass system restrictions...

PT-2024-39176 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS affected versions not specified Description: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as...

WordPress Community by PeepSo plugin <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via content Parameter vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Community by PeepSo versions = 6.4.5.0...

WordPress The Events Calendar Pro plugin <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Administrator+ PHP Object Injection to Remote Code Execution vulnerability discovered by István Márton in WordPress Plugin The Events Calendar PRO versions = 7.0.2...

WordPress CRM Perks Forms plugin <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload vulnerability

Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin CRM Perks Forms versions = 1.1.3...

WordPress ParityPress plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin ParityPress versions = 1.0.0...

PT-2024-7482 · Mitel · Nupoint Messenger +1

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP1 9.8.1.5 Description: A vulnerability in the NuPoint Messenger component could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution ...

PT-2024-28724 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Haven blog web application affected versions not specified Description: A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires...

WordPress RegLevel plugin <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin RegLevel versions = 1.2.1...

WordPress AI ChatBot for WordPress – WPBot plugin <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin ChatBot versions = 5.5.7...

CVE-2024-5911

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

CVE-2024-5911 PAN-OS: File Upload Vulnerability in the Panorama Web Interface

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which...

Palo Alto Networks Panorama Security Breach

Palo Alto Networks Panorama is a solution from Palo Alto Networks, USA that supports centralized management and configuration of firewalls. The product supports features such as network traffic monitoring and threat management. A security vulnerability exists in Palo Alto Networks Panorama that...

WordPress Bit Form plugin <= 2.12.3 - Authenticated (Administrator+) Arbitrary File Upload vulnerability

Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Bit Form versions = 2.12.3...

CVE-2024-37350

There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can interfere with a system administrator’s use of the policy management UI when the attacker convinces the victim administrator to follow a crafted link to the...

PT-2024-27494 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.06 Description: There is a cross-site scripting issue in the policy management UI. Attackers can interfere with a system administrator's use of the policy management UI when the attacker convinces t...

CVE-2024-31401

Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product...

PT-2024-8590

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 November Security Update Ivanti Endpoint Manager versions prior to 2022 SU6 November Security Update Description The issue is related to SQL injection in Ivanti Endpoint Manager, which allows a...

PT-2024-6300 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions before 2022 SU6 Ivanti EPM versions before the 2024 September update Description: The issue is related to an unspecified SQL injection in Ivanti EPM, which allows a remote authenticated attacker with admin privileges to...