PMWeb 跨站脚本漏洞

PMWeb is a web-based platform from PMWeb Inc. It is used to manage the lifecycle of a user's schedule and build operations. A cross-site scripting vulnerability exists in PMWeb version 7.2.00, which stems from an unknown feature of the component Web Application Firewall that can lead to cross-sit...

CVE-2024-6567

The Ebook Store plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 5.8001. This is due to the plugin utilizing fpdi-protection and not preventing direct access to test files that have displayerrors set to true. This makes it possible for unauthenticat...

CVE-2024-6567

CVE-2024-6567 affects the WordPress Ebook Store plugin (versions up to 5.8001). The root cause is a Full Path Disclosure caused by the plugin using fpdi-protection and failing to block direct access to test files that have display_errors enabled. This unauthenticated disclosure can reveal the web...

CVE-2024-41961

Summary of CVE-2024-41961 (Elektra) : Elektra, a Ruby on Rails-based OpenStack dashboard, contains a code injection vulnerability in its live search functionality. An authenticated user can provide a search term that includes Ruby code, which flows to an eval sink and can execute arbitrary code. ...

CVE-2024-41961 Elektra vulnerable to remote code execution in universal search

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...

CVE-2024-2090

CVE-2024-2090 — The WordPress plugin Remote Content Shortcode (versions

The vulnerability in the `app\admin\groups\edit-group.php` file of the PHPIPAM web application allows a attacker to perform XSS attacks.

The vulnerability in the app\admin\groups\edit-group.php file of the IP address management web application exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-41954 FOG Weak file permissions

FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accoun...

The vulnerability in the `app\admin\groups\edit-group.php` file of the PHPIPAM web application allows a attacker to perform XSS attacks.

The vulnerability in the app\admin\groups\edit-group.php file of the IP address management web application exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

ROS-20240730-12

Vulnerability in Django web application software platform is related to unrestricted resource allocation. resources. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service DoS. denial of service DoS...

IBM Aspera Orchestrator 代码问题漏洞

IBM Aspera Orchestrator is a Web-based application from International Business Machines IBM, Inc. It can provide an efficient file processing pipeline for data-driven organizations. A code issue vulnerability exists in IBM Aspera Orchestrator version 4.0.1 that stems from not invalidating a sessi...

AMPLE BILLS 1.0 Administrative Page Disclosure

============================================================================================================================================= | Title : AMPLE BILLS v1.0 Administrative Page Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

The vulnerability of the Express.js template for Node.js web application development, related to the redirection of URL addresses to unreliable websites used by the incoming component, allows attackers to redirect users to arbitrary URL addresses.

The vulnerability of the Express.js template for Node.js web application development is related to open redirection, involving incorrectly formed URL addresses. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses remotely...

CVE-2024-6546

The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the ful...

CVE-2024-6566

The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has displayerrors enabled. This makes it possible for...

CVE-2024-6545

The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full pa...

CVE-2024-6549 Admin Post Navigation <= 2.1 - Unauthenticated Full Path Disclosure

The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full pat...

CVE-2024-6549

CVE-2024-6549 (Admin Post Navigation, WordPress) enables unauthenticated full path disclosure in all versions up to 2.1 due to bootstrap usage and test files with display_errors enabled. This Information Exposure is not by itself destructive but can aid other attacks; exploitation requires anothe...

CVE-2024-6573

CVE-2024-6573 affects the WordPress Intelligence plugin and describes a Full Path Disclosure vulnerability in all versions up to and including 1.4.0. The issue arises because the plugin does not block direct access to /vendor/levelten/intel/realtime/index.php and because display_errors is enabled...

CVE-2024-6545 Admin Trim Interface <= 3.5.1 - Unauthenticated Full Path Disclosure

The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full pa...