CVE-2023-30998

CVE-2023-30998 affects IBM Security Verify Access Docker (versions 10.0.0.0–10.0.7.1). Root cause: improper access controls allowing a local user to obtain root. Impact: local privilege escalation on affected containers. Remediation: upgrade to 10.0.8.0 or later (IBM guidance; docker pull icr.io/...

CVE-2023-30998 IBM Security Access Manager Docker privilege escalation

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649...

Talya Informatics Travel APPS SQL Injection Vulnerability

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A SQL injection vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass authentication using misconfigured...

Talya Informatics Travel APPS Security Breach

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A security vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass user control key authorization using...

ROS-20240627-01

A vulnerability in the implementation of the CORS mechanism of Microsoft Edge and Google Chrome browsers is related to weaknesses in the access controls. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and disclose protected...

Security Bulletin: IBM Security Verify Access is vulnerable to multiple Security Vulnerabilities

Summary The IBM Security Verify Access Appliance and IBM Security Verify Access Container has addressed multiple vulnerabilities in release 10.0.8.0. Vulnerability Details CVEID:CVE-2023-38371 DESCRIPTION: IBM Security Access Manager uses weaker than expected cryptographic algorithms that could...

CVE-2024-5455 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion

The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the 'magazinestyle' parameter within the Dynamic Smart Showcase widget. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-5503 WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion

The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the...

CVE-2024-5503

CVE-2024-5503 refers to a Local File Inclusion flaw in the WP Blog Post Layouts plugin for WordPress, affecting all versions up to 1.1.3. The vulnerability allows authenticated users with Contributor+ rights to include and execute arbitrary PHP files on the server, potentially bypassing access co...

Authorization Bypass

ezsystems/ez-support-tools is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access controls, allowing any authenticated backend user, regardless of their assigned permissions, to view sensitive system information such as phpinfo output...

CVE-2024-4098

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uufetchsharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

CVE-2024-4098 Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uufetchsharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

The vulnerability of Kubernets Rancher cluster management software lies in the lack of access restrictions on protected information. This allows attackers to expose the protected data and gain administrative control over the Kubernetes cluster.

The vulnerability of Kubernets Rancher cluster management software is related to the lack of restrictions on access to protected information. Exploiting this vulnerability allows a malicious actor to disclose protected data and gain administrative control over the Kubernetes cluster...

CVE-2024-5574

The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files ...

CVE-2024-5574

CVE-2024-5574 affects WP Magazine Modules Lite for WordPress (all versions up to 1.1.2). The vulnerability is Local File Inclusion via the blockLayout parameter, enabling authenticated users with Contributor-level access or higher to include and execute arbitrary PHP files on the server, potentia...

CVE-2024-4258 Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion

The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the...

CVE-2024-3813 tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'tdblocktitle' shortcode 'blocktemplateid' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

CVE-2024-3813 tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode

The tagDiv Composer plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8 via the 'tdblocktitle' shortcode 'blocktemplateid' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and...

UBUNTU-CVE-2024-36287

Mattermost Desktop App versions =5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS...

Rockwell Automation FactoryTalk View SE

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.2 ATTENTION : Exploitable remotely/Low attack complexity Vendor : Rockwell Automation Equipment : FactoryTalk View SE Vulnerability : Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an outside attacker...