2238 matches found
CVE-2024-5551 WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion
The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicat...
CVE-2024-5558
CWE-367: Time-of-check Time-of-use TOCTOU Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account...
CVE-2024-5558
CWE-367: Time-of-check Time-of-use TOCTOU Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account...
CVE-2024-5558
CVE-2024-5558 is a TOCTOU race condition vulnerability in Schneider Electric SpaceLogic AS-P (and AS-B) prior to or at version 5.0.3, enabling privilege escalation via abuse of a restricted admin account. The Red Hat/NVD entries describe CWE-367; CNNVD specifies SpaceLogic AS-P v5.0.3 and earlier...
CVE-2024-36264
CVE-2024-36264 concerns Apache Submarine Commons Utils with an improper authentication flaw. The issue arises if submarine.auth.default.secret is not set, as a default secret is used, potentially enabling unauthorized access. Affected version: 0.8.0 and later; note the project is retired and no f...
CVE-2024-5313
CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impact...
CVE-2024-37178
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can...
CVE-2024-37178
CVE-2024-37178 describes an XSS vulnerability in SAP Financial Consolidation caused by insufficient encoding of user-controlled inputs. The affected component(s) expose endpoints over the network, allowing exploitation with a network attack vector and low to moderate privileges. Impact is describ...
CVE-2024-37178 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can...
PT-2024-4202 · Schneider Electric · Spacelogic As-B
Name of the Vulnerable Software and Affected Versions: Schneider Electric SpaceLogic AS-P and SpaceLogic AS-B affected versions not specified Description: A Time-of-check Time-of-use TOCTOU Race Condition issue exists, potentially allowing an attacker to escalate privileges by abusing a limited...
CVE-2024-27838
The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user...
CVE-2024-27833
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, tvOS 17.5, visionOS 1.2. Processing maliciously crafted web content may lead to arbitrary code execution...
CVE-2024-27830
This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. A maliciously crafted webpage may be able to fingerprint the user...
CVE-2024-3850
Affected product: Uniview NVR301-04S2-P4. Vulnerability: reflected cross-site scripting (XSS) via the PATH of LAPI. Root cause: improper neutralization of input during web page generation (CWE-79), with XSS possible on pages under /LAPI/. Some sources note authentication is required; others indic...
CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting
Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...
CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting
Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...
The vulnerability of the Register method in the Telerik Report Server reporting framework allows a malicious actor to access limited functions.
The vulnerability of the Register method in the Telerik Report Server reporting framework relates to bypassing authentication processes through spoofing. Exploiting this vulnerability can allow unauthorized users to gain access to limited features of the system...
Fedora: Security Advisory for qt5-qtquickcontrols2 (FEDORA-2024-2e27372d4c)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...