CVE-2024-33309

An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository...

CVE-2024-33309

An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information via an insecure API endpoint. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository...

CVE-2024-33308

An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Emergency Contact Feature. NOTE: this is disputed as discussed in the msn-official/CVE-Evidence repository...

CVE-2024-33308

CVE-2024-33308 affects TVS Connet for Android v4.5.1 and iOS v5.0.0, enabling remote privilege escalation via the Emergency Contact Feature. Root cause and exact exploitation details are not provided across the sources, but multiple entries note the dispute around the vulnerability (CVE-Evidence ...

WordPress Tutor LMS plugin <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update vulnerability

Missing Authorization to Unauthenticated Limited Options Update vulnerability discovered by M.Awad in WordPress Plugin Tutor LMS versions = 2.6.2...

CVE-2024-33558 WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

CVE-2024-33558 WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5...

CVE-2024-4163

The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal IGX. However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exe...

CVE-2024-4163 Privilege Escalation on Skylab IIoT Gateway (IGX)

The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal IGX. However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exe...

CVE-2024-4163 Privilege Escalation on Skylab IIoT Gateway (IGX)

The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal IGX. However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exe...

CVE-2024-4163

The CVE-2024-4163 issue affects Skylab IGX IIoT Gateway. The limited shell (IGX) runs with root privileges, enabling an attacker to read, write, and modify any OS file via shell file exec/download functions. By replacing /etc/passwd with a new root entry, the attacker can breakout to an unrestric...

CVE-2024-33670

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...

PT-2024-29472 · Skylab · Skylab Igx Iiot Gateway

Name of the Vulnerable Software and Affected Versions: Skylab IGX IIoT Gateway affected versions not specified Description: The Skylab IGX IIoT Gateway has a security issue where the limited shell terminal process runs under root privileges, allowing an attacker to read, write, and modify any fil...

WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability

Limited Arbitrary File Upload vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin XStore Core versions = 5.3.8...

Server Side Request Forgery

github.com/usememos/memos is vulnerable to Server Side Request Forgery. The vulnerability is due to improper input validation at the /o/get/httpmeta endpoint in the file httpgetter.go, allowing unauthenticated users to enumerate the internal network and receive limited HTML values in JSON form...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie versions prior to 1.4.0 that stems from a safescrapehtml function that utilizes a user-controlled URL to make requests to a remote server that are not...

memos 安全漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which stems from /o/get/httpmeta allows unauthenticated users to enumerate the internal network and receive limited html values in the form of json...

CVE-2023-40146

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...

CVE-2023-40146

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...

CVE-2023-40146

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can authenticate with hard-coded credentials and execute unblocke...