WordPress LuckyWP Table of Contents plugin <= 2.1.4 - Authenticated(Administrator+) Cross-Site Scripting vulnerability

AuthenticatedAdministrator+ Cross-Site Scripting vulnerability discovered by Akbar Kustirama in WordPress Plugin LuckyWP Table of Contents versions = 2.1.4...

CVE-2021-22508

A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries. An attack requires to be an authenticated administrator of OBR with network access to the OBR web application...

CVE-2021-22508

CVE-2021-22508 affects OpenText Operations Bridge Reporter. The vulnerability allows SQL injection via the OBR web application, requiring an authenticated administrator with network access. The available documents do not specify affected versions, exact vulnerable component, exploit details, or a...

CVE-2021-22508 Potential SQL injection in OpenText Operations Bridge Reporter

A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries. An attack requires to be an authenticated administrator of OBR with network access to the OBR web application...

CVE-2021-22508 Potential SQL injection in OpenText Operations Bridge Reporter

A potential vulnerability has been identified for OpenText Operations Bridge Reporter. The vulnerability could be exploited to inject malicious SQL queries. An attack requires to be an authenticated administrator of OBR with network access to the OBR web application...

CVE-2024-3319

CVE-2024-3319 affects SailPoint Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints. An authenticated administrator could execute user-defined templates as part of attribute transforms, enabling remote code execution on the host. Root cause: templating code e...

SailPoint Delimited File Connector 安全漏洞

SailPoint Delimited File Connector is a read-only and rule-driven connector from SailPoint. A security vulnerability exists in the SailPoint Delimited File Connector that stems from a file path traversal vulnerability that could allow an authenticated administrator to set arbitrary connector...

WordPress Falang multilanguage for WordPress plugin <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Falang multilanguage versions = 1.3.49...

CVE-2024-2846 Visual Footer Credit Remover <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting

The Visual Footer Credit Remover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'selector' parameter in all versions up to, and including, 2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Mitel 6800 SIP 和 6900 SIP 安全漏洞

The Mitel 6800 SIP and Mitel 6900 SIP are both products of Mitel Canada.The Mitel 6800 SIP is a 6800 SIP series IP phone.The Mitel 6900 SIP is a 6900 SIP series IP phone. A security vulnerability exists in the Mitel 6800 SIP and 6900 SIP that stems from insufficient parameter cleanup, which allow...

QNAP Systems QuFirewall 路径遍历漏洞

QNAP Systems QuFirewall is a built-in firewall application for QNAP devices from China Weilian Technology QNAP Systems. A path traversal vulnerability exists in QNAP Systems QuFirewall 2.4.1 and prior versions, which originates from a vulnerability that allows an authenticated administrator to re...

CVE-2024-20358

A vulnerability in the Cisco Adaptive Security Appliance ASA restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level...

WordPress Icegram Express plugin <= 5.7.15 - Authenticated (Administrator+) Cross-Site Scripting via CSV import vulnerability

Authenticated Administrator+ Cross-Site Scripting via CSV import vulnerability discovered by Peter17 in WordPress Plugin Email Subscribers & Newsletters versions = 5.7.15...

CVE-2024-3022

The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpressprocessupload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to...

WordPress File Manager plugin <= 7.2.5 - Authenticated (Administrator+) Directory Traversal vulnerability

Authenticated Administrator+ Directory Traversal vulnerability discovered by DarkT in WordPress Plugin File Manager versions = 7.2.5...

PT-2024-5037 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow:dockerized versions prior to 2024-04 Description: The issue is related to the rspamd maps function and involves improper path validation, allowing for path traversal and arbitrary code execution. This can enable an authenticated admin...

CVE-2024-3061

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and...

PT-2024-22774 · Svr-116 · Svr-116

Name of the Vulnerable Software and Affected Versions: SVR-116 firmware version 1.6.0.30028871 Description: The issue allows a remote authenticated attacker with administrative privileges to execute arbitrary OS commands by sending a specially crafted request to the product. Recommendations: For...

CVE-2024-2449

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF...

CVE-2024-2449 LoadMaster Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostname of a specific LoadMaster, to direct an authenticated LoadMaster administrator to a third-party site. In such a scenario, the CSRF...