SonicOS Multiple Post-authentication Vulnerabilities

1 CVE-2024-12803 - SonicOS Post-authentication Stack-based buffer overflow vulnerabilityA post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. CVSS Score: 6.0 CVSS Vector:...

CVE-2024-12429

An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A successfully authenticated attacker can use this vulnerability to read system wide files and configuration All AC500 V3 products PM5xxx with...

CVE-2024-12849

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

CVE-2024-12849 Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

CVE-2024-12849

The Error Log Viewer By WP Guru WordPress plugin (up to version 1.0.1.3) is affected by an Arbitrary File Read through the wp_ajax_nopriv_elvwp_log_download action. Unauthenticated attackers can read arbitrary server files, exposing sensitive data. Remediation: upgrade the plugin to a version new...

CVE-2024-12849 Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

PT-2025-1667

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to, and including, 4.24.15 Description The WordPress File Upload plugin is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion due to the lack of proper sanitization of...

Intersec Geosafe-ea 缓冲区错误漏洞

Intersec Geosafe-ea is an application from Intersec France. A security vulnerability exists in Intersec Geosafe-ea versions 2022.12, 2022.13, and 2022.14, which stems from the presence of an XML External Entity Injection vulnerability that could allow an attacker to perform an arbitrary file read...

WordPress plugin Error Log Viewer By WP Guru 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...

WordPress Error Log Viewer plugin <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read vulnerability

Missing Authorization to Unauthenticated Arbitrary File Read vulnerability discovered by yudha in WordPress Plugin Error Log Viewer versions = 1.0.1.3...

PT-2025-20134

Name of the Vulnerable Software and Affected Versions SysAid On-Prem versions 23.3.40 and earlier Description SysAid On-Prem is affected by an unauthenticated XML External Entity XXE issue in the Server URL processing functionality. This allows for administrator account takeover and file read...

CVE-2024-12583

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it...

CVE-2024-12583

CVE-2024-12583 affects the Dynamics 365 Integration plugin for WordPress (versions up to and including 1.3.23). Root cause: missing input validation on the render function enables Twig Server-Side Template Injection. Impact: authenticated attackers with Contributor-level access and above can exec...

PT-2025-1899 · Microsoft · Dynamics 365 Integration Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Dynamics 365 Integration plugin for WordPress version 1.3.23 and earlier Description: The issue is related to Remote Code Execution and Arbitrary File Read due to missing input validation and sanitization on the render function, allowing...

WordPress Dynamics 365 Integration plugin <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability

Authenticated Contributor+ Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Dynamics 365 Integration versions = 1.3.23...

Adobe ColdFusion < 2021.x < 2021u18 / 2023.x < 2023u12 Path Traversal (APSB24-107)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 18 or 2023.x update 12. It is, therefore, affected by a vulnerability as referenced in the APSB24-107 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerabili...

WordPress Error Log Viewer by WP Guru 1.0.1.3 Arbitrary File Read Vulnerability

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the...

PT-2025-3738

Name of the Vulnerable Software and Affected Versions: Abacus ERP versions prior to 2024.210.16036 Abacus ERP versions prior to 2023.205.15833 Abacus ERP versions prior to 2022.105.15542 Description: The issue is an authenticated arbitrary file read vulnerability. This means that an attacker who...