Race condition

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition...

CVE-2023-34348

CVE-2023-34348 affects AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior. The vulnerability allows an unauthenticated, remote attacker to crash the PI Message Subsystem of a PI Server, yielding a denial-of-service condition. The issue is categorized as an Improper Check or Handling of Exce...

CVE-2023-31274 Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service...

CVE-2024-22416 Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery CSRF attac...

PT-2024-5113 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The SolarWinds Access Rights Manager was found to have an authentication bypass issue, allowing an unauthenticated user to gain domain admin access within the Activ...

hw: intel: Improper input validation in some Intel(R) PROSet/Wireless WiFi

An improper input validation flaw was found in some IntelR PROSet/Wireless WiFi and KillerTM WiFi software that may allow an unauthenticated user to enable a denial of service via adjacent access...

Multiple TP-Link products vulnerable to OS command injection

Overview Multiple products provided by TP-LINK contain multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2024-21773 OS command injection CWE-78 - CVE-2024-21821 OS command injection CWE-78 - CVE-2024-21833 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to...

CVE-2023-6830 Formidable Forms <= 6.7 - HTML Injection

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected...

CVE-2023-6042

Any unauthenticated user may send e-mail from the site with any title or content to the admin...

CVE-2023-6042

CVE-2023-6042 affects Getwid (a WordPress plugin) with versions prior to 2.0.3. The vulnerability allows any unauthenticated user to trigger the site to send an email to the administrator with arbitrary headers/content, through the WordPress admin-ajax endpoint (action=getwid_send_mail). PoCs and...

pyload Unauthenticated Flask Configuration Leakage vulnerability

Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. PoC Run pyload in the default configuration by...

CVE-2024-21644

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77...

Design/Logic Flaw

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77...

PT-2024-14860 · WordPress +1 · Getwid

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows any unauthenticated user to send email from the site with any title or content to the admin. Recommendations: At the moment, there is n...

CVE-2023-50344

CVE-2023-50344 : HCL DRYiCE MyXalytics is affected by an improper access control vulnerability that allows unauthenticated users to download certain files. Public sources in NVD/NIST describe the issue as an unauthenticated file download with network-attack vector and low to moderate impact on co...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

Confluence Pre-Auth Remote Code Execution via OGNL Injection...

Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object Injection

Description The plugin unserializes user input via some of its cookies, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget chain is present on the blog PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup...

Information disclosure

Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For...

CVE-2023-51708

Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For...

CVE-2023-51708

Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For...