CVE-2023-52943

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors...

CVE-2024-11398

CVE-2024-11398 affects Synology Router Manager (SRM) prior to version 1.3.1-9346-9, via an improper limitation of a pathname in the OTP reset functionality (path traversal). The vulnerability could allow remote authenticated users to delete arbitrary files through unspecified vectors. Documented ...

CVE-2024-11398

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2024-11398

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2024-11398: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in OTP reset functionality in Synology Router Manager SRM before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors...

CVE-2023-52943: Incorrect Authorization

Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors...

CVE-2024-53672

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system...

CVE-2024-53672

A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploit could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system...

CVE-2024-52958 iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature

A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function...

CVE-2024-52958 iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature

A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function...

CVE-2024-51031

A Cross-site Scripting XSS vulnerability in manageaccount.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "First Name," "Middle Name," and "Last Name" fields...

CVE-2024-51031: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability in manageaccount.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "First Name," "Middle Name," and "Last Name" fields...

CVE-2024-51032

A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field...

CVE-2024-48427

A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manageservice&id...

CVE-2024-48427

A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manageservice&id...

CVE-2024-38002

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote...

CVE-2024-38002

The CVE-2024-38002 issue affects Liferay Portal and Liferay DXP, where the workflow component does not properly enforce permission checks when updating a workflow definition via the headless API. This allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE...

Synology DiskStation Manager Improper Neutralization of Special Elements used in an OS Command (CVE-2022-22688)

Improper neutralization of special elements used in a command 'Command Injection' vulnerability in File service functionality in Synology DiskStation Manager DSM before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors. This plugin only works wi...

Synology DiskStation Manager OS Command Injection (CVE-2021-29083)

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Improper Neutralization of Special Elements used in an OS Command (CVE-2022-27616)

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in webapi component in Synology DiskStation Manager DSM before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors. This plugin only works with...