CVE-2024-5080

The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the embed feature. An attacker can access unpublished or private resource data by inferring the slug or URL of the resource that can be embedded. Note: This is only exploitable if the resource allows embedding a...

CVE-2023-7062

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive...

GHSA-JFGP-674X-6Q4P Weblate vulnerable to improper sanitization of project backups

Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. Patches This issue has been addressed in Weblate 5.6.2 via...

PT-2024-26883 · Cososys +1 · Cososys Unify +1

Name of the Vulnerable Software and Affected Versions: Netwrix CoSoSys Endpoint Protector versions 5.9.3 and earlier CoSoSys Unify versions 7.0.6 and earlier Description: The issue concerns a remote code execution vulnerability in the Endpoint Protector and Unify agent. This vulnerability arises...

CVE-2024-2023

CVE-2024-2023 affects WordPress plugins Folders (<= 3.0) and Folders Pro (

PT-2024-27348 · Microsoft +1 · Azure Blob Storage +1

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions 2.1.0 through 2.14.3 Description: The issue allows an attacker with a CVAT account to exploit a feature by specifying custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob...

CVE-2024-28020

A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. If exploited a malicious high-privileged user could use the passwords and login information through complex routines to extend access on the server and other services...

Hitachi FOXMAN-UN Security Vulnerability

Hitachi FOXMAN-UN is a powerful toolset in a comprehensive NMS suite from Hitachi, Japan Hitachi. A security vulnerability exists in Hitachi FOXMAN-UN and UNEM, which stems from a user password reuse vulnerability that could allow a malicious user to extend access to servers and other services...

PT-2024-22215 · Unknown · Foxman-Un/Unem

Name of the Vulnerable Software and Affected Versions: FOXMAN-UN/UNEM affected versions not specified Description: A user/password reuse issue exists in the FOXMAN-UN/UNEM application and server management. If exploited, a malicious high-privileged user could use the passwords and login informati...

GHSA-4542-P56H-8XWW Cross-Site Scripting (XSS) vulnerabilities in Neos

It has been discovered that Neos is vulnerable to several XSS attacks. Through these vulnerabilities, an attacker could tamper with page rendering, redirect victims to a fake login page, or capture user credentials such as cookies. With the potential backdoor upload an attacker could gain access ...

UBUNTU-CVE-2024-34004

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include...

PT-2024-40142 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A cross-site scripting issue has been found in the output table listing of the "Files" backend module. This occurs when a file extension contains malicious sequences. To exploit thi...

CVE-2024-25975

CVE-2024-25975 affects the HAWKI application (Interaction Design Team, University of Applied Sciences) and is tied to a path-traversal in the up/downvote feature. The POST parameters are not properly filtered, allowing an authenticated attacker to write arbitrary files on the server by supplying ...

UBUNTU-CVE-2024-28826

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

Redmine 安全漏洞

Redmine is a suite of open source web-based project management and defect tracking tools. The product provides features such as project management, issue tracking and role-based access control. A security vulnerability exists in Redmine DMSF versions prior to 3.1.4, which stems from the presence ...

Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

The MITRE Corporation has revealed that the cyber attack targeting the not-for-profit company towards late December 2023 by exploiting zero-day flaws in Ivanti Connect Secure ICS involved the threat actor creating rogue virtual machines VMs within its VMware environment. "The adversary created...

CVE-2024-31396

Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on...

PT-2024-13728 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL injection while getting file server details. Recommendations: For Zoho ManageEngine ADAudit Plus versions below 7271, update to version 7271 or later to...

The vulnerability of the SuiteCRM customer relationship management system lies in the lack of restrictions on file downloads. This allows a malicious actor to execute or open files on the web server without having access to those files.

The vulnerability of the SuiteCRM customer relationship management system is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to execute or open files on the web server without having access to those files...