6707 matches found
Enel X Waybox 安全漏洞
Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox that stems from a web management application that can be used to execute arbitrary operating system commands and provide administrator privileges to the Waybox system...
Exploit for CVE-2024-50475
CVE-2024-50475 Signup Page = 1.0 - Unauthenticated Arbitra...
PT-2024-39909 · WordPress · Pods
Name of the Vulnerable Software and Affected Versions: The Pods WordPress plugin versions prior to 3.2.7.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...
CVE-2024-8934
Beckhoff TwinCAT Package Manager is affected by a local command injection vulnerability. A local user with administrative rights can enter specially crafted values in the UI to cause arbitrary OS commands to execute. The vulnerability is associated with TwinCAT Package Manager versions prior to 1...
CVE-2024-28875
A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be...
PT-2024-7559 · D Link · D-Link Dsl-6740C
Name of the Vulnerable Software and Affected Versions: D-Link DSL-6740C version 6.TR069.20211230 Description: The issue is related to the use of weak password requirements in the D-Link DSL-6740C router's software component. This could allow a remote attacker to escalate their privileges. The...
CVE-2024-9475
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the orderby parameter in all versions up to, and including, 5.4.6 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...
CVE-2024-46902
A vulnerability in Trend Micro Deep Discovery Inspector DDI versions 5.8 and above could allow an attacker to disclose sensitive information affected installations. Please note: an attacker must first obtain the ability to execute high-privileged code admin user rights on the target system in ord...
CVE-2024-40087
Vilo 5 Mesh WiFi System = 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router...
PT-2024-28775 · Unknown · Vilo 5 Mesh Wifi System
Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions 5.16.1.33 and earlier Description: The issue is related to Insecure Permissions, specifically a lack of authentication in the custom TCP service on port 5432. This allows remote, unauthenticated attackers to...
CVE-2024-20420
A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. This vulnerability is due to incorrect authorization verification by the HTTP server...
CVE-2024-9582
The Accordion Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ attribute of an accordion slider in all versions up to, and including, 1.9.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Appointment Booking Calendar plugin <= - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability
Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...
PT-2024-39699
Name of the Vulnerable Software and Affected Versions Accordion Slider plugin for WordPress versions up to, and including, 1.9.11 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the html attribute of an accordion slider...
VulnCheck KEV: CVE-2020-36832
The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user...
PT-2024-31652 · Apache · Apache Cloudstack
Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.7.0 through 4.18.2.3 Apache CloudStack versions 4.19.0.0 through 4.19.1.1 Description: The CloudStack Quota feature, which is disabled by default, allows cloud administrators to implement a quota or usage limit...
CVE-2024-9953
A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...
PT-2024-39231 · WordPress · Wp Post Author
Name of the Vulnerable Software and Affected Versions: WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress versions up to, and including, 3.8.1 Description: The...
PT-2024-6958 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated...
Privilege Escalation
github.com/rancher/rancher vulnerable to Privilege Escalation. The vulnerability is due to improper restrictions in node driver options, allowing unprivileged users to deploy nodes and post sensitive files such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml...