CVE-2024-21689

CVE-2024–21689 RCE Bamboo Data Center and Server Atlassian Puntuación CVSS - 7.6 🔥 Descripción Esta vulnerabilidad RCE Ejecución Remota de Código de alta gravedad CVE-2024-21689 se introdujo en las versiones 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 y 9.6.0 de Bamboo Data Center and Server. Esta...

exploit-CVE-2016-8016-25

McAfee Virus Scan para Linux: múltiples fallos remotos ESTE EXPLOIT Y TODO EL CÓDIGO EN ESTE REPOSITORIO FUERON ELIMINADOS PARA EVITAR CUALQUIER PROBLEMA RELACIONADO CON LA VIOLACIÓN DE CUALQUIER LICENCIA DE MCAFEE McAfee VirusScan Enterprise para Linux es una solución antivirus empresarial de...

CVE-2024-50849

CVE-2024-50849: Stored XSS in the WorldServer v11.8.2 A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. An authenticated high-privileged user must go to the "Rules" page...

CVE-2021-30146

CVE-2021-30146 Seafile 7.0.5 XSS Persistente Descripción sugerida: La aplicación versión del servidor: Seafile 7.0.5 es vulnerable a XSS persistente a través de la funcionalidad de compartir bibliotecas. Información adicional: Seafile es una solución de sincronización y uso compartido de archivos...

CVE-2023-46003

CVE-2023-46003 XSS almacenado en i-doit Pro 25 y versiones anteriores i-doit Pro 25 y versiones anteriores son vulnerables a una vulnerabilidad de XSS almacenado. Esto podría permitir a atacantes autenticados remotos con privilegios bajos o altos almacenar datos peligrosos payload XSS o página HT...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is affected by a privilege escalation vulnerability through mass assignment in versions up to and including 1.5.39 . The root cause lies in the add_sub_account_user function, which passes the raw userdata array to wp_insert_user without filt...

EUVD-2026-76858

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting the...

CVE-2023-5965

PoC para Espo CRM 7.2.4 CVE-2023-5965 y CVE-2023-5965 CVE-2023-5965 Aviso Un atacante autenticado con privilegios podría subir un zip especialmente manipulado al servidor EspoCRM en la versión 7.2.5, a través del formulario de actualización, lo que podría llevar a la ejecución arbitraria de códig...

CVE-2026-89268

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-90453

CVE-2026-90453 affects a file-upload handler that redirects an authenticated client's browser to a URL taken directly from the request's Referer header , without validating it against the application's own origin. An authenticated attacker can craft a request that causes another user's browser to...

EUVD-2026-75768

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...

EUVD-2026-75775

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2022-48311

CVE-2022-48311 HP Deskjet 2540 series impresora versión de firmware CEP1FN1418BR y número de modelo de producto A9U23B página de configuración HTTP vulnerabilidad de Cross Site Scripting XSS Description Cross Site Scripting XSS en la impresora HP Deskjet 2540 series, versión de firmware...

artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

GHSA-23RH-XW42-FQ82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reportsconfig permission can inject...

CVE-2026-87090 Consul vulnerable to an authorization bypass in the catalog node-write path

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...

CVE-2026-64838

ICEcoder (a web-based code editor) versions through 8.1 are affected by a path traversal vulnerability in the oldFileName parameter used during file move and rename operations. Because the parameter is not properly validated, an authenticated attacker can inject path traversal sequences to reloca...

CVE-2024-7593

CVE-2024-7593 Descripción: CVE-2024-7593 es una vulnerabilidad crítica que afecta a múltiples productos de Pulse Secure, incluido Pulse Secure VPN. Esta vulnerabilidad permite a un atacante autenticado con acceso a la interfaz de administración ejecutar comandos arbitrarios en el servidor afectad...

CVE-2026-84062

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused...

PT-2026-89580

TRC analysis shows authenticated attackers are exploiting CVE-2026-87020 to crash Orthanc DICOM servers by uploading malicious PNG/JPEG images. The integer overflow triggers heap corruption, disrupting medical imaging operations across healthcare facilities. Healthcare Vulnerability :link: Full...