CVE-2024-2849

The CVE-2024-2849 entry concerns SourceCodester Simple File Manager 1.0. The vulnerability arises from incorrect handling of the photo argument, enabling unrestricted file uploads. This is described as a remote, critical issue with publicly disclosed exploit information. Affected component: Simpl...

Patch Ivanti Standalone Sentry and Ivanti Neurons for ITSM now

Ivanti has issued patches for two vulnerabilities. One was discovered in the Ivanti Standalone Sentry, which impacts all supported versions 9.17.0, 9.18.0, and 9.19.0. Older versions are also at risk. The other vulnerability impacts all supported versions of Ivanti Neurons for ITSM—2023.3, 2023.2...

Ivanti Releases Security Updates for Neurons for ITSM and Standalone Sentry

Ivanti has released security advisories to address vulnerabilities in Ivanti Neurons for ITSM and Standalone Sentry. A cyber threat actor could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Ivanti advisories a...

SA: CVE-2023-46808 (Authenticated Remote File Write) for Ivanti Neurons for ITSM

Created Date Mar 20, 2024 2:26:49 AM...

PT-2024-12861 · A.K.I · Pmailserver +1

Name of the Vulnerable Software and Affected Versions: A.K.I Software's PMailServer/PMailServer2 products affected versions not specified Description: A directory traversal vulnerability exists in the Mailing List Search CGI pmmls.exe included in the products. This vulnerability can be exploited ...

panorama.pm Web Interface File Load

The vulnerability of the panorama.pm web interface of the monitoring console for Naemon, Nagios, Icinga, and Shinken THRUK relates to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to download any file remotely...

CVE-2024-25153

A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web portal’s DocumentRoot, specially craft...

CVE-2024-2406

A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...

BIT-MLFLOW-2023-6976 Unrestricted Upload of File with Dangerous Type

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process...

CVE-2024-2155

A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been...

CVE-2024-2155

A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been...

CVE-2024-2155

The CVE-2024-2155 vulnerability affects SourceCodester Best POS Management System 1.0 and involves an index.php file inclusion: manipulating the page argument enables potential inclusion of local files. Multiple connected sources confirm this is a remote-vector issue with unknown specifics about ...

PT-2024-18961 · Sourcecodester · Sourcecodester Best Pos Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best POS Management System version 1.0 Description: A problematic issue affects the processing of the file index.php, where the manipulation of the page argument leads to file inclusion. This issue can be initiated remotely...

CVE-2024-2150

A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to t...

Design/Logic Flaw

A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to t...

Remote file inclusion

A local file inclusion LFI in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customersupport/index.php...

CVE-2024-2059

A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/servicecrud.php. The manipulation of the argument photo leads to unrestricted upload. The attack may be...

CVE-2024-1921

A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the...

WordPress Canto Remote Shell Upload

Exploit Title: Wordpress Plugin Canto " def createadminfilelocaldir, localshell=None: if not os.path.exis...

Wordpress Plugin Canto < 3.0.5 - Remote File Inclusion (RFI) and Remote Code Execution (RCE)

Exploit Title: Wordpress Plugin Canto " def createadminfilelocaldir, localshell=None: if not os.path.existslocaldir: os.makedirslocaldir If...