Ruijie BCR810W/BCR860 vulnerable to OS command injection

Overview Network router BCR810W/BCR860 provided by Ruijie Networks Co., Ltd. contains an OS command injection vulnerability CVE-2023-3608, CWE-78. Note that this vulnerability can only be exploited when the BCOS port of the product is connected to the Internet. JPCERT/CC has confirmed attacks...

CVE-2022-28132

The T-Soft E-Commerce 4 web application is susceptible to SQL injection SQLi attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.102 - Authenticated (Admin+) Command Injection vulnerability

Authenticated Admin+ Command Injection vulnerability discovered by wesley wcraft in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 1.5.102...

PT-2024-8596 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 November Security Update Ivanti Endpoint Manager versions prior to 2022 SU6 November Security Update Description: The issue is related to a lack of protection against SQL query structure...

WordPress Custom Field Suite plugin <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Eduardo Berlanga seqode in WordPress Plugin Custom Field Suite versions = 2.6.5...

PT-2024-13428

Name of the Vulnerable Software and Affected Versions Media Streaming add-on versions prior to 500.1.1.5 Description An OS command injection issue has been reported, affecting the Media Streaming add-on. This could allow authenticated administrators to execute commands via a network. The issue is...

WordPress WP Front User Submit / Front Editor plugin <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan in WordPress Plugin WP Front User Submit / Front Editor versions = 4.4.7...

WordPress AnnounceKit plugin <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan in WordPress Plugin AnnounceKit versions = 2.0.9...

WordPress SVS Pricing Tables plugin <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan in WordPress Plugin SVS Pricing Tables versions = 1.0.4...

QNAP Systems QuFirewall path traversal vulnerability

QNAP Systems QuFirewall is a built-in firewall application for QNAP devices from China Weilian Technology QNAP Systems. A path traversal vulnerability exists in QNAP Systems QuFirewall version 2.4.1 and prior versions that could allow an authenticated administrator to read the contents of a file...

PT-2024-21044 · Iris · Iris

Name of the Vulnerable Software and Affected Versions: Iris versions prior to 2.4.6 Description: Iris is a web collaborative platform that helps incident responders share technical details during investigations. Due to an improper setup of the Jinja2 environment, reports generation in iris-web is...

CVE-2024-31077

Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service DoS condition...

PT-2024-3246 · Mitel · Mitel 6900 Series +2

Name of the Vulnerable Software and Affected Versions: Mitel 6800 Series versions through 6.3 SP3 HF4 Mitel 6900 Series versions through 6.3 SP3 HF4 Mitel 6900w Series versions through 6.3.3 Mitel 6970 Conference Unit versions through 5.1.1 SP8 Description: The issue is related to insufficient...

WordPress WooCommerce Google Feed Manager plugin <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting vulnerability

Authenticated Admin+ SQL Injection to Reflected Cross-Site Scripting vulnerability discovered by Krzysztof Zając in WordPress Plugin WooCommerce Google Feed Manager versions = 2.4.2...

CVE-2024-3054

WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstggetcustomexcludepathfree action. This is due to the plugin not providing sufficient path validation on the...

CVE-2024-22448

Dell BIOS contains an Out-of-Bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service...

PT-2024-7479 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions 9.7.1.110 and earlier Description: A vulnerability in the Suite Applications Services component could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient...

PT-2024-18308 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: WordPress Infinite Scroll – Ajax Load More plugin for WordPress versions up to, and including, 7.0.1 Description: The issue allows authenticated attackers with administrator-level access and above to read the contents of arbitrary files on th...

WordPress FancyBox for WordPress plugin 3.0.2 - 3.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

WordPress FancyBox for WordPress plugin 3.0.2 - 3.3.3 - Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Sh in WordPress Plugin FancyBox for WordPress versions 3.0.2 - 3.3.3...

CVE-2024-30270 mailcow Path Traversal and Arbitrary Code Execution Vulnerability

mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the rspamdmaps...