8373 matches found
CVE-2024-7145
CVE-2024-7145 : JetElements (WordPress) is vulnerable to authenticated Local File Inclusion via the progress_type parameter in versions up to 2.6.20. Exploitation allows an authenticated attacker (Contributor+ level) to include and execute arbitrary PHP files on the server, bypassing some access ...
CVE-2024-7146
The JetTabs for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.3 via the 'switcherpreset' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...
CVE-2024-7146
CVE-2024-7146 affects JetTabs for Elementor (WordPress plugin) up to v2.2.3. It allows authenticated users with Contributor-level access and above to perform Local File Inclusion via the switcher_preset parameter, enabling inclusion/ execution of arbitrary PHP code on the server and potentially b...
Dorsett Controls InfoScan < 1.38 Multiple Vulnerabilities (July 2024)
The version of Dorsett Controls InfoScan running on the remote host is prior to 1.38. It is, therefore, affected by multiple vulnerabilities: - Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. CVE-2024-392...
WordPress Profilepro 1.3 Cross Site Scripting Vulnerability
Exploit Title: profilepro if !response.ok throw new Error'Network response was not ok'; return response.text; .thendata = console.logdata .catcherror = console.error'Error:', error; - As an admin, go to http://example.com/wp-admin/edit.php?posttype=profileproform - Choose the default profile, cli...
CVE-2021-26387
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...
CVE-2021-26387
CVE-2021-26387 describes insufficient access controls in the AMD ASP kernel that could allow a privileged attacker with access to AMD signing keys and BIOS/UEFI shell to map DRAM regions into protected areas, risking platform integrity. Public documents indicate this CVE is tracked within AMD sec...
CVE-2021-26387
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...
CVE-2021-26387
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity...
Improper Access Control
Apache DolphinScheduler is vulnerable to Improper Access Control. The vulnerability is due to there is no proper validation on access controls that allowing authenticated users to illegally access additional resource files...
CVE-2024-41732 Improper Access Control in SAP Netweaver Application Server ABAP
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read ...
PT-2024-28193 · Unknown · Olive One Click Demo Import
Name of the Vulnerable Software and Affected Versions: Olive One Click Demo Import versions 1.1.2 and earlier Description: The issue allows exposure of sensitive information to an unauthorized actor due to accessing functionality not properly constrained by ACLs. Recommendations: For Olive One...
WordPress Profilepro 1.3 Cross Site Scripting
Exploit Title: profilepro if !response.ok throw new Error'Network response was not ok'; return response.text; .thendata = console.logdata .catcherror = console.error'Error:', error; - As an admin, go to http://example.com/wp-admin/edit.php?posttype=profileproform - Choose the default profile, cli...
Schneider Electric Accutech Manager
GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...
Johnson Controls exacqVision Web Server Installed (Windows)
Binary data exacqvisionwebserverwininstalled.nbin...
Johnson Controls ExacqVision Web Server Inadequate Encryption Strength (JCI-PSA-2024-14)
The version of the Johnson Controls exacqVision Web Server running on the remote host is affected by an inadequate encryption strength vulnerability. Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchange. Note...
Johnson Controls exacqVision Web Service < 24.06 Multiple Vulnerabilities
The version of the Johnson Controls exacqVision Web Service running on the remote host is prior to 24.03. It is, therefore, affected by multiple vulnerabilities. - Under certain circumstances the exacqVision Web Services does not provide sufficient protection from untrusted domains. CVE-2024-3286...
Johnson Controls ExacqVision Web Server < 24.04 Improper Certificate Validation (JCI-PSA-2024-18)
The version of the Johnson Controls exacqVision Web Server running on the remote host is prior to 24.04. It is, therefore, affected by a certificate validation vulnerability. Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected...
