CVE-2024-34883

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request...

CVE-2024-34885

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request...

CVE-2024-34885

Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request...

CVE-2024-34885

The CVE-2024-34885 entry concerns Bitrix24 (1C-Bitrix Bitrix24) version 23.300.100, where credentials in SMTP server settings are insufficiently protected. The underlying issue allows remote administrators to read SMTP account passwords via an HTTP GET request. The vulnerability impacts confident...

Virtuozzo Hybrid Server 7.5 Update 7 (7.5.7-129)

Virtuozzo Hybrid Server 7.5 Update 7 introduces a way to convert system containers to virtual machines, support for Ubuntu 24.04 LTS, and bug fixes. Additionally, it provides a new kernel 3.10.0-1160.119.1.vz7.224.4. Vulnerability id: PSBM-159393 Memory corruption leading to a crash in nodes in...

CVE-2024-34891

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange account passwords via HTTP GET request...

CVE-2024-34883

Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request...

Exploit for SQL Injection in Portabilis I-Educar

CVE-2024-48325 Description: An authenticated user can...

CVE-2024-41738

IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques...

CVE-2024-41738 IBM TXSeries for Multiplatforms information disclosure

IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques...

CVE-2024-41738

CVE-2024-41738 affects IBM TXSeries for Multiplatforms 10.1. The issue allows an attacker to obtain sensitive information from the query string of an HTTP GET request, potentially via man-in-the-middle techniques. The primary root cause is exposure of sensitive data in HTTP GET query strings. Imp...

SmartAgent 1.1.0 SQL Injection

Exploit Title: SmartAgent v1.1.0 - Unauthenticated SQL Injection SQLi Date: 01-10-2024 Exploit Author: Alter Prime Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com Version: Build v1.1.0 Tested on: Kali Linux An unauthenticated user can inject SQL queries through a POST request ...

SmartAgent 1.1.0 Server-Side Request Forgery

Exploit Title: SmartAgent v1.1.0 - Server-Side Request Forgery SSRF Date: 01-10-2024 Exploit Author: Alter Prime Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com Version: Build v1.1.0 Tested on: Kali Linux An unauthenticated user can trigger the web server to perform web reques...

CVE-2024-9430

The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the cttepfwwploaded function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attacke...

CVE-2024-9430 Get Quote For Woocommerce – Request A Quote For Woocommerce <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download

The Get Quote For Woocommerce – Request A Quote For Woocommerce plugin for WordPress is vulnerable to unauthorized access of Quote data due to a missing capability check on the cttepfwwploaded function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attacke...

CVE-2024-9430

CVE-2024-9430 affects Get Quote For Woocommerce – Request A Quote For Woocommerce (WordPress) up to version 1.0.0. Root cause: missing capability check in ct_tepfw_wp_loaded function, enabling unauthenticated access to Quote data. Impact: unauthorized download of Quote PDF and CSV documents. Publ...

JeecgBoot 安全漏洞

JeecgBoot is a Java low-code platform for enterprise web applications from China National Torch Jeecg. A security vulnerability exists in JeecgBoot version v3.7.1, which was discovered to contain an SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData...

CVE-2024-51300

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the getrrd function...

ABB Cylon Aspect 3.08.01 jsonProxy.php Cross Site Scripting

ABB Cylon Aspect 3.08.01 jsonProxy.php Unauthenticated Reflected XSS Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy manageme...

WordPress Get Quote For Woocommerce Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Get Quote For Woocommerce Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9430 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ed4687422c20 Credits stehled Required...