PT-2024-13022 · Win Zapp · Win Zapp

Name of the Vulnerable Software and Affected Versions: Win ZApp versions prior to 4.3.0 Description: The issue is related to an arbitrary file deletion in ZSATrayManager, which is responsible for protecting the temporary encrypted ZApp issue reporting file from unprivileged end user access and...

Zscaler Client Connector 安全漏洞

Zscaler Client Connector is an application from zscaler. An application installed on a device that ensures that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A security...

PT-2024-18637 · WordPress · Buddypress Woocommerce My Account Integration

Name of the Vulnerable Software and Affected Versions: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress versions up to, and including, 3.4.20 Description: The issue concerns PHP Object Injection via deserialization of untrusted input in the get...

PT-2024-2912 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability is due to incorrect restriction of the directory path name with limited...

The vulnerability of the CLI interface of ArubaOS operating systems allows a hacker to gain access to delete any files they desire and to cause service interruptions.

The vulnerability of the CLI interface of ArubaOS operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access and delete any files they desire, as well as cause service failures...

Simple Job Board < 2.11.1 - Unauthenticated PHP Object Injection via Job Application Fields

Description The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the jobboardapplicantlistcolumnsvalue function. This makes it possible for unauthenticated attackers to inject a PHP...

SonicWALL Email Security Appliance Path Traversal Vulnerability

The SonicWALL Email Security Appliance is an email security appliance from SonicWALL, Inc. A path traversal vulnerability exists in the SonicWALL Email Security Appliance that stems from the presence of path traversal, which could allow a remote attacker with administrative privileges to conduct ...

CVE-2024-2006

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpostshortcodemetaboxmarkup function. This makes it...

Deserialization of untrusted data

The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input via shortcode. This makes it possible for authenticated attackers, with contributor access and...

PT-2024-18293 · WordPress · Play.Ht

Name of the Vulnerable Software and Affected Versions: Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress versions up to, and including, 3.6.4 Description: The issue allows authenticated attackers with contributor-level access and above to inject a PHP Object...

PT-2024-9560 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-9 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the OTP reset functionality. This...

IBM DS8900F HMC Arbitrary File Deletion Vulnerability

The IBM DS8900F HMC is an enterprise-class disk storage system from International Business Machines IBM for storing and managing large-scale enterprise data. The IBM DS8900F HMC suffers from an arbitrary file deletion vulnerability that can be exploited by an attacker to arbitrarily delete files...

CVE-2023-46169

IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406...

CVE-2023-46169

IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406...

Code injection

IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily delete a file. IBM X-Force ID: 269406...

CVE-2023-46169

CVE-2023-46169 affects IBM DS8900F HMC and could allow an authenticated user to arbitrarily delete files. Affected product/versions include DS8900F HMC firmware: R9.2 (89.22.19.0) and R9.3 (89.30.68.0, 89.32.40.0, 89.33.48.0). Remediation is provided in Microcode Bundle 89.40.89.0 (R9.4 GA2); CVE...

Arbitrary file deletion

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the handledeletedmedia function in all versions up to, and including,...

CVE-2024-1170

The CVE-2024-1170 entry concerns the BuddyForms (Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions) WordPress plugin. A missing capability check in the handle_deleted_media function allows unauthenticated attackers to delete arbitrary med...

ArubaOS < 8.10.0.10 / 8.11.2.1 / 10.4.1.0 / 10.5.1.0 Multiple Vulnerabilities (ARUBA-PSA-2024-002)

The version of ArubaOS installed on the remote host is 8.x prior to 8.10.0.10, 8.11 prior to 8.11.2.1, 10.4 prior to 10.4.1.0, or 10.5 prior to 10.5.1.0. It is, therefore, affected by multiple vulnerabilities including: - An authenticated command injection vulnerabilities exist in the ArubaOS...

WordPress Plugin buddyforms security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...