CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF

This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to exploit this...

Exploit for SQL Injection in Abocms Abo.Cms

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227...

BIT-DISCOURSE-2023-23935 Presence of restricted personal Discourse messages may be leaked if tagged with a tag

Discourse is an open-source messaging platform. In versions 3.0.1 and prior on the stable branch and versions 3.1.0.beta2 and prior on the beta and tests-passed branches, the count of personal messages displayed for a tag is a count of all personal messages regardless of whether the personal...

Information disclosure

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process...

PT-2024-21974 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.19 Description: The issue is a Cross Site Scripting XSS vulnerability that resides in the File Manager module of the admin panel. It arises due to inadequate sanitization of user input in the "New directory" field...

PT-2024-2868 · Cdata +1 · Cdata Connect +1

Name of the Vulnerable Software and Affected Versions: CData Connect versions prior to 23.4.8846 Description: A path traversal vulnerability exists in the Java version of CData Connect when running using the embedded Jetty server. This could allow an unauthenticated remote attacker to gain comple...

CVE-2023-39254

Dell Update Package DUP, Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin...

Cross site request forgery (csrf)

In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...

CVE-2024-0689

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a meta import in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the meta values. This makes it possible for authenticated attackers, with...

CVE-2023-50437

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2...

CVE-2023-50437

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2...

Design/Logic Flaw

An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2...

Stormshield Network Security Security Vulnerabilities

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in Stormshield Network Security that stems from the fact that an administrator with write access can configure login disclaimers using...

PT-2024-18465 · WordPress · The Restaurant Solutions – Checklist

Name of the Vulnerable Software and Affected Versions: The Restaurant Solutions – Checklist plugin for WordPress version 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via the Checklist points due to insufficient input sanitization and output escaping. This allows...

PT-2024-15752 · WordPress · Custom Field Suite

Name of the Vulnerable Software and Affected Versions: Custom Field Suite plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to Stored Cross-Site Scripting via a meta import due to insufficient input sanitization and output escaping on the meta values. Thi...

CVE-2023-50437

A security vulnerability exists in Couchbase Server prior to version 7.2.4 . The issue is caused by a logic flaw where the otpCookie is granted full admin access on the /pools/default/serverGroups and engageCluster2 endpoints. This incorrect privilege assignment could allow unauthorized administr...

CVE-2023-7167

The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

MikroTik RouterOS Path Traversal (CVE-2019-15055)

MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 improperly handles the disk name, which allows authenticated users to delete arbitrary files. Attackers can exploit this vulnerability to reset credential storage, which allows them access to the management interface as an administrator...

Denial of service

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with...

CVE-2024-0435

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS rende...