4366 matches found
Code injection
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin = 3.2.7 versions...
CVE-2023-47668
The CVE concerns the StellarWP Membership Plugin – Restrict Content, affecting versions ≤ 3.2.7. The root cause is exposure of sensitive information to an unauthorised actor via the plugin’s legacy log mechanism (noted as legacy rcp-debug.log exposure). Practical impact is unauthenticated access ...
PT-2023-28093 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to an Uncontrolled Search Path Element vulnerability, which allows for Leveraging/Manipulating Configuration File Search Paths. This vulnerability enables access to the...
PT-2023-7469 · Openssl · Openssl
Name of the Vulnerable Software and Affected Versions: openssl aka node-openssl versions through 2.0.0 Description: The issue is related to the absence of input data sanitization in the openssl package of the NPM package manager. This allows a remote attacker to execute arbitrary commands by...
Restrict Content < 3.2.8 - Information Exposure via legacy log file
Description The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7 via the legacy log file. This makes it possible for unauthenticated attackers to extract sensitive data including debug information...
PT-2023-7273 · Sysaid · Sysaid
Name of the Vulnerable Software and Affected Versions: SysAid versions prior to 23.2.15 Description: The issue allows for Indirect Object Reference IDOR attacks, enabling unauthorized access to protected information. This can be achieved by modifying the sid parameter to EmailHtmlSourceIframe.jsp...
PT-2023-28688 · Dell · Powerprotect Agent For File System
Name of the Vulnerable Software and Affected Versions: PowerProtect Agent for File System versions 19.14 and prior Description: The issue is related to incorrect default permissions in the ddfscon component, allowing a low-privileged local attacker to potentially overwrite log files...
PT-2023-7559 · Zoho · Zoho Manageengine Recovery Manager Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine RecoveryManager Plus versions prior to 6070 Description: The issue allows admin users to execute arbitrary commands via proxy settings. This is due to a failure to neutralize special elements, which can be exploited by a...
WordPress Plugin Membership Plugin - Restrict Content Information Disclosure Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Membership Plugin - Restri...
PT-2023-31056 · 7 Zip · 7Za
Name of the Vulnerable Software and Affected Versions: NZBGet version 21.1 Description: The issue allows authenticated remote code execution due to the unarchive programs 7za and unrar preserving executable file permissions. An attacker with Control capability can execute a file by setting the...
PT-2023-32525 · M Files · M-Files Server
Name of the Vulnerable Software and Affected Versions: M-Files server versions prior to 23.11.13156.0 Description: A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server, which allows attackers to execute...
PT-2023-30702 · Tenda · Tenda Ax1803
Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue is related to a stack overflow via the time parameter in the saveParentControlInfo function, allowing attackers to cause a Denial of Service DoS attack. Recommendations: For Tenda AX1803...
PT-2023-30565 · Unknown · Lukman Nakib Preloader Matrix
Name of the Vulnerable Software and Affected Versions: Lukman Nakib Preloader Matrix versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...
PT-2023-32557 · Unknown · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.16 through 3.4.0a Description: A critical issue affects the processing of the file /admin/theme-edit.php, leading to code injection. The attack can be initiated remotely. Recommendations: For versions 3.3.16 through...
PT-2023-8942 · Gpac +2 · Gpac +2
Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev566-g50c2ab06f-master Description: The issue is related to the gf filterpacket del function in the /gpac/src/filter core/filter.c file of the GPAC multimedia platform. It involves incorrect use of dynamic memory, which...
PT-2023-30724 · Grocy · Grocy
Name of the Vulnerable Software and Affected Versions: Grocy versions prior to 4.0.4 Description: The issue allows attackers to inject arbitrary HTML content without script execution, occurring when user-supplied data is not properly sanitized. This enables the injection of HTML tags through...
PT-2023-30695 · Unknown · Xxl-Job-Admin
Name of the Vulnerable Software and Affected Versions: xxl-job-admin version 2.4.0 Description: The issue allows for Remote Code Execution RCE via the /xxl-job-admin/jobcode/save API endpoint. Recommendations: For xxl-job-admin version 2.4.0, as a temporary workaround, consider restricting access...
PT-2023-30726 · Grocy · Grocy
Name of the Vulnerable Software and Affected Versions: Grocy version 4.0.3 Description: The issue allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within the "/equipment/" component. Recommendations: For Grocy version 4.0.3...
