PT-2025-46530

Name of the Vulnerable Software and Affected Versions libvirt affected versions not specified Description A flaw exists in libvirt related to XML file processing. Specifically, user-provided XML files are parsed before Access Control List ACL checks. A malicious user with limited permissions coul...

Synology DiskStation Manager Path Traversal (CVE-2021-33182)

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in PDF Viewer component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. This plugin only works with Tenable.ot. Please...

PT-2024-22584 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: A web application in the Infinera hiT 7300 allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations. This issue can lead to unauthoriz...

CVE-2024-8725 Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with...

CVE-2024-8725

CVE-2024-8725 affects the WordPress plugin Advanced File Manager (

CVE-2024-8725 Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with...

The vulnerability of the Hot Backup File component in the MongoDB database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Hot Backup File component in the MongoDB database management system relates to the possibility for users with limited privileges to download backup files, along with obtaining a unique identifier for the backup copy. Exploiting this vulnerability could allow an attacker,...

CVE-2024-44187

A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...

The vulnerability of the Ivanti EPM endpoint management software, related to defects in the deserialization mechanism, allows a hacker to access limited functions of the software.

The vulnerability of the Ivanti EPM endpoint management software relates to the bypassing of authentication processes. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to limited functions of the software...

CVE-2024-45104

A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2024-2373)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP10 : libtiff (EulerOS-SA-2024-2446)

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2024-2423)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-4465

An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. If a logged-in user with reporting privileges learns how to create a specific application request, they might be able to make...

Nozomi Networks Guardian/CMC 安全漏洞

Nozomi Networks Guardian/CMC is a centralized management console from Nozomi Networks, Inc. in the United States. A security vulnerability exists in Nozomi Networks Guardian/CMC that stems from access controls in the reporting section not being properly enforced for limited privilege users, which...

Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0

Summary An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. Impact If a logged-in user with reporting privileges learns how to create a specific application request, they might be...

CVE-2024-6876

Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service...

CVE-2024-21753

A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or...

CVE-2024-45280

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...