15220 matches found
CVE-2024-38206
Microsoft Copilot Studio contains CVE-2024-38206: an authenticated attacker can bypass SSRF protections to leak sensitive information over the network. Affected product: Microsoft Copilot Studio. Root cause per the entry is insufficient validation allowing SSRF bypass. Impact is information discl...
Microsoft Copilot Studio Information Disclosure Vulnerability
An authenticated attacker can bypass Server-Side Request Forgery SSRF protection in Microsoft Copilot Studio to leak sensitive information over a network...
CVE-2024-5708
The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...
CVE-2023-5000 Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode
The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
Microsoft Copilot Studio 代码问题漏洞
Microsoft Copilot Studio is an artificial intelligence chatbot from Microsoft Corporation USA. A code issue vulnerability exists in Microsoft Copilot Studio that originates from an authenticated attacker who can bypass server-side request forgery SSRF protections, resulting in the disclosure of...
mailcow 安全漏洞
mailcow is a mail server suite from mailcow open source. A security vulnerability exists in versions prior to mailcow 2024-07, which originated from a vulnerability that allows an authenticated attacker to bypass 2FA protection, thereby allowing unauthorized access to other accounts protected wit...
CVE-2024-38876
CVE-2024-38876 affects Siemens Omnivise T3000 components (Application Server, Domain Controller, PDM, R8.2 SP3/ SP4, Terminal Server, Thin Client, Whitelisting Server). The vulnerability allows a local authenticated attacker to execute arbitrary code with elevated privileges because the affected ...
CVE-2024-38876
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 All versions, Omnivise T3000 Domain Controller R9.2 All versions, Omnivise T3000 Product Data Management PDM R9.2 All versions, Omnivise T3000 R8.2 SP3 All versions, Omnivise T3000 R8.2 SP4 All versions, Omnivise T3000...
WordPress plugin Spectra Pro 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...
Siemens Omnivise T3000 安全漏洞
The Omnivise T3000 is a distributed control system for fossil fuel and large renewable energy power plants. A code execution vulnerability exists in the Siemens Omnivise T3000 Application Server that could be exploited by a local, authenticated attacker to execute arbitrary code with elevated...
Cross-site Scripting (XSS)
Magento-lts is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper system config sanitisation within the design/header/welcome, design/header/logosrc, design/header/logosrcsmall, and design/header/logoalt, which allows an admin authenticated attacker to perform Cross-site...
CVE-2024-41915
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify sensitive information in...
WordPress plugin Bold Page Builder 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin SiteOrigin Widgets Bundle 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
Command or parameter injection via unique embedded switch SNMP commands (CVE-2024-5461)
Implementation of the Simple Network Management Protocol SNMP operating on the Brocade 6547 FC5022 embedded switch blade, makes internal script calls to system.sh from within the SNMP binary. An authenticated attacker could perform command or parameter injection on SNMP operations that are only...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js - follow-redirects-1.15.4
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js - follow-redirects-1.15.4 Vulnerability Details CVEID:CVE-2024-28849 DESCRIPTION: Node.js follow-redirects module could allow a remote authenticated attacker to obtain sensitive information, caused by...
CVE-2024-6881
Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session...
CVE-2024-6881
Stored XSS in M-Files Hubshare versions before 5.0.6.0 allows an authenticated attacker to execute arbitrary JavaScript in user's browser session...
