CVE-2024-3164

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...

PT-2024-24175 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS affected versions not specified Description: The issue is related to the System-Maintenance- Log Files in the dotCMS dashboard, which is providing the username/password for database connections in the log output. This is considered a...

CVE-2024-3164: Improper Access Control

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...

PT-2024-24172 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS version 22.02 Description: The issue concerns the dotCMS dashboard, specifically the Tools and Log Files tabs under System → Maintenance Portlet. This portlet, which is intended for Admin access, is accessible to anyone with the portle...

CVE-2024-29201

JumpServer (open source bastion host) has a vulnerability in its Ansible workflow that allows bypassing input validation to execute arbitrary code inside the Celery container, which runs with root privileges and has database access. Exploitation could lead to unauthorized data access or manipulat...

CVE-2023-6371

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf...

CVE-2023-50374

Server-Side Request Forgery SSRF vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10...

CVE-2023-50374

CVE-2023-50374 is a reported SSRF vulnerability in the WordPress plugin CMP – Coming Soon & Maintenance by NiteoThemes. The issue affects versions from unspecified start (n/a) up to 4.1.10 . The connected Red Hat advisory RH:CVE-2023-50374 mirrors the same description and confirms the SSRF impact...

CVE-2023-50374 WordPress CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin <= 4.1.10 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10...

CVE-2023-50374: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & Maintenance: from n/a through 4.1.10...

WordPress CGC Maintenance Mode Plugin <= 1.2 is vulnerable to Bypass Vulnerability

Software CGC Maintenance Mode Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-30480 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 8d06778f1eec Credits Mika Required privilege...

WordPress CMP – Coming Soon & Maintenance Plugin <= 4.1.10 is vulnerable to Server Side Request Forgery (SSRF)

Software CMP – Coming Soon & Maintenance Type Plugin Vulnerable versions = 4.1.10 Fixed in 4.1.11 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2023-50374 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID...

PT-2024-13929

Name of the Vulnerable Software and Affected Versions NiteoThemes CMP – Coming Soon & Maintenance versions through 4.1.10 Description A Server-Side Request Forgery SSRF issue affects the software, allowing unauthorized access to internal resources. This can be exploited by manipulating requests t...

The vulnerability of the microprogrammed software of the PowerFlex 527 variable frequency converter, related to uncontrolled resource consumption, allows a intruder to trigger a maintenance failure.

The vulnerability of the microprogrammed software of the PowerFlex 527 variable frequency converter is related to uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause maintenance failures by sending specially crafted network requests remotely...

CVE-2024-1473

The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mo...

CVE-2024-1473

The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mo...

CVE-2024-1477

The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the REST API. This makes it possible for authenticated attackers to obtain post and page content via REST API thus bypassign the protection provided by th...

CVE-2024-1181

The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUESTURI to determine if the page being accesses is an admin area. This makes it...

CVE-2024-1181 Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass

The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUESTURI to determine if the page being accesses is an admin area. This makes it...

CVE-2024-1181

CVE-2024-1181 applies to the WordPress plugin Coming Soon, Under Construction & Maintenance Mode By Dazzler. All versions up to 2.1.2 are vulnerable because the plugin uses REQUEST_URI to decide if a page is in admin area, allowing unauthenticated attackers to bypass maintenance mode. Remediation...