146 matches found
B&R Industrial Automation B&R APROL 代码问题漏洞
B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation of Austria. A code issue vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-00P5, which stems from a server-side request forgery in the APROL Web Portal, which could allow...
Precurio Intranet Portal 4.4 Remote Command Execution
Precurio Intranet Portal version 4.4 suffers from a remote command execution vulnerability. Exploit Title: Precurio Intranet Portal 4.4 - Remote Command Execution Discovered by: Ahmet Ümit BAYRAM Discovered Date: 05.03.2024 Vendor Homepage: https://www.precurio.com Software Link:...
CVE-2024-56433
shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...
Winmail Server 安全漏洞
Winmail Server is a server-side application used to provide mail services by China Huazhao Winmail Company. A security vulnerability exists in Winmail Server version 4.4, which stems from the inclusion of a cross-site scripting vulnerability...
PT-2024-8893 · Intel · Intel Ethernet Network Controllers/Adapters E810 Series
Name of the Vulnerable Software and Affected Versions: IntelR Ethernet Network Controllers and Adapters E810 Series versions prior to 4.4 Description: The issue is related to a protection mechanism failure in the firmware of some Intel Ethernet Network Controllers and Adapters. This failure may...
PT-2024-5267 · Supermicro · Supermicro X11Dph-Tq +2
Name of the Vulnerable Software and Affected Versions: Supermicro X11DPH-T versions prior to BIOS firmware 4.4 Supermicro X11DPH-Tq versions prior to BIOS firmware 4.4 Supermicro X11DPH-i versions prior to BIOS firmware 4.4 Description: A vulnerability was discovered in the SMM callout component ...
VulnCheck KEV: CVE-2016-5734
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace e aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...
WordPress UX Flat Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
Software UX Flat Type Plugin Vulnerable versions = 4.4 Fixed in 4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2459 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1c4ff3eaa36d Credits Francesco Carlucci Required privileg...
CVE-2023-4728
The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the publishlp function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for authenticated attackers with subscriber-level access and abov...
CVE-2023-4731
The LadiApp plugn for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the initendpoint function hooked via 'init' in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to modify a variety of settings, via a forged request...
PT-2024-13434 · WordPress · Ladiapp
Name of the Vulnerable Software and Affected Versions: LadiApp plugin for WordPress versions up to, and including, 4.4 Description: The issue arises from a missing capability check on the publish lp function, which is hooked via an AJAX action. This allows authenticated attackers with...
WordPress LadiApp Plugin <= 4.4 is vulnerable to Broken Access Control
Software LadiApp Type Plugin Vulnerable versions = 4.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4728 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0b2bf88149e4 Credits GiongfNef Required privilege Subscriber...
WordPress 4.4.x < 4.4.32 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A PHP file upload bypass via Plugin Installer requiring admin privileges. - An RCE POP Chains vulnerability. Note that the scanner has not tested for these issues but has...
PT-2023-30460 · Gl.Inet · Gl-Inet Ax1800
Name of the Vulnerable Software and Affected Versions: GL.iNet AX1800 versions 4.0.0 through 4.4.x Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the gl nas sys authentication function. This enables the attacker to potentially gain unauthorized...
Admin Tools Application Cross-Site Request Forgery Vulnerability
Admin Tools Application is an open source advanced administration tool for XWiki from the XWiki Foundation. A cross-site request forgery vulnerability exists in Admin Tools Application versions 4.4 through 4.5.1, which can be exploited to allow an attacker to execute arbitrary shell commands by...
CVE-2023-39999
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4...
CVE-2023-25044
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sumo Social Share Boost plugin = 4.4 versions...
WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Oxygen Builder Type Plugin Vulnerable versions 4.4 Fixed in 4.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46841 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 25f9e69541d6 Credits RE-ALTER Required privileg...
CVE-2023-23647 WordPress Team Member Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. author+ Stored Cross-Site Scripting XSS vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin = 4.4 versions...
