2683 matches found
CVE-2024-12371
A device takeover vulnerability exists in the Rockwell Automation Power Monitor 1000. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and...
PT-2024-17450 · WordPress · Sikshya Lms
Name of the Vulnerable Software and Affected Versions: Sikshya LMS plugin for WordPress versions up to, and including, 0.0.21 Description: The issue is related to Reflected Cross-Site Scripting via the page parameter due to insufficient input sanitization and output escaping. This allows...
Directus 信息泄露漏洞
Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus version 11.0.0 and versions prior to 11.3.0, which stems from a setting of WEBSOCKETSGRAPHQLAUTH or...
CVE-2024-37302
Synapse (Matrix homeserver) versions before 1.106 are vulnerable to a disk-fill DoS where an unauthenticated attacker can cause extensive remote-media downloads and caching due to inadequate default rate limiting. Synapse 1.106 adds a leaky-bucket rate limit on remote media downloads to help miti...
CVE-2024-5890
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this...
CVE-2024-5890 HTML Injection in the Assessment plugin
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this...
CVE-2024-5890 HTML Injection in the Assessment plugin
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this...
CVE-2024-5890
Technical details beyond the description are not provided in the connected documents. Monitor for updates from ServiceNow and vendors; apply patches when available.
Wordpress POST SMTP Account Takeover
The POST SMTP WordPress plugin prior to 2.8.7 is affected by a privilege escalation where an unauthenticated user is able to reset the password of an arbitrary user. This is done by requesting a password reset, then viewing the latest email logs to find the associated password reset email. Module...
CVE-2024-11599
CVE-2024-11599 affects Mattermost where input-based email validation failure allows an unauthenticated user to bypass email domain restrictions during registration. Affected versions include 9.5.x (<= 9.5.11), 9.11.x (<= 9.11.3), 10.0.x (<= 10.0.1), and 10.1.x (9.5.11, >9.11.3, >10...
PT-2024-17129 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.11 Mattermost versions 9.11.x through 9.11.3 Mattermost versions 10.0.x through 10.0.1 Mattermost versions 10.1.x through 10.1.1 Description: The issue is related to the improper validation of email...
CVE-2024-10240
An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project,...
CVE-2024-10240 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project,...
CVE-2024-10240
CVE-2024-10240 concerns GitLab EE where an unauthenticated user may read information about an MR in a private project under certain circumstances. Affected are GitLab EE versions: 17.3 prior to 17.3.7; 17.4 prior to 17.4.4; and 17.5 prior to 17.5.2. The CVSS base score is 5.3 (Medium) with networ...
CVE-2024-8525
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
CVE-2024-8525 Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
CVE-2024-8525
CVE-2024-8525 affects Automated Logic WebCTRL 7.0 (Premium Server). The issue is an unrestricted upload of a file with a dangerous type that an unauthenticated attacker can exploit via a crafted HTTP POST to achieve remote command execution and upload of a malicious file. Multiple connected sourc...
CVE-2024-11334
The CVE-2024-11334 entry concerns the WordPress plugin My Contador lesr. A missing capability check in exportar_registros() allows unauthenticated attackers to export user data in all versions up to 2.0. The vulnerability is triggered by insufficient access control on the CSV export path, enablin...
PT-2024-17000 · Peepso · The Community By Peepso
Name of the Vulnerable Software and Affected Versions: The Community by PeepSo plugin for WordPress versions up to, and including, 6.4.6.2 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...
