6721 matches found
CVE-2024-8102
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the modulealltoggleajax function in all versions up to, and including, 3.0.8. This makes it possible...
PT-2024-38689
Name of the Vulnerable Software and Affected Versions Pulpcore versions 3.0 and later Gunicorn versions prior to 22.0 Description An authentication bypass issue has been identified due to Apache's mod proxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...
PT-2024-38030
Name of the Vulnerable Software and Affected Versions Foreman versions 6.13 through 6.15 Foreman with Gunicorn versions prior to 22.0 Description An authentication bypass issue has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This...
PT-2024-13702 · Unknown · Visual Planning Admin Center
Name of the Vulnerable Software and Affected Versions: Visual Planning Admin Center 8 versions prior to v.1 Build 240207 Description: The issue is related to insufficient access checks, allowing attackers with non-administrative accounts to utilize functions normally reserved for administrators...
PT-2024-38285 · WordPress · Ninja Forms
Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.8.11 Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs because the Ninja Forms WordPress plugin does not escape an...
CVE-2024-8016
The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and...
Digital China Networks DCME-320 安全漏洞
Digital China Networks DCME-320 is a wireless router from Digital China Networks China. A security vulnerability exists in the Digital China Networks DCME-320 version v.7.4.12.60, which originates from the getVar function in the code/function/system/tools/ping.php file that can be used to gain...
PT-2024-38860
Name of the Vulnerable Software and Affected Versions: Flowise version 1.8.2 Description: An Authentication Bypass issue exists, allowing a remote, unauthenticated attacker to access API endpoints as an administrator and access restricted functionality. Recommendations: For Flowise version 1.8.2,...
CVE-2024-45187 Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution
Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...
WordPress WP Table Builder plugin < 1.6.0 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP Table Builder versions 1.6.0...
PT-2024-26998 · Swissphone · Swissphone Dical-Red 4009
Name of the Vulnerable Software and Affected Versions: Swissphone DiCal-RED 4009 affected versions not specified Description: The issue allows a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password...
PT-2024-6121 · Github · Github Enterprise Server
Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14 GitHub Enterprise Server versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16 are not affected, all versions prior to these are vulnerable. Description: The issue is related to an XML signature wrappin...
PT-2024-37859 · WordPress · Wordsurvey
Name of the Vulnerable Software and Affected Versions: WordSurvey plugin for WordPress versions up to, and including, 3.2 Description: The issue is related to Stored Cross-Site Scripting via the sounding title parameter due to insufficient input sanitization and output escaping. This allows...
CVE-2024-44076
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...
PT-2024-37907 · WordPress · Wp Multitasking
Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The issue is related to a lack of CSRF check when updating exit popups, which could allow attackers to make logged admins perform such actions via a CSRF attack. This...
GHSA-2FF6-837J-HG5X Magento OS Command ('OS Command Injection') vulnerability
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an admin attacker. Exploitation of this issue requires user...
Fortra GoAnywhere MFT 安全漏洞
Fortra GoAnywhere MFT is a secure file transfer solution from Fortra USA. A security vulnerability exists in Fortra GoAnywhere MFT versions prior to 7.6.0 that stems from an authentication bypass vulnerability that allows an administrator user with access to the agent console to bypass certain...
PT-2024-20790 · Helpsystems · Goanywhere Mft
Name of the Vulnerable Software and Affected Versions: GoAnywhere MFT versions prior to 7.6.0 Description: An authentication bypass issue allows Admin Users with access to the Agent Console to circumvent some permission checks, potentially leading to unauthorized information disclosure or...
PT-2024-26327 · Openbmc · Openbmc
Name of the Vulnerable Software and Affected Versions: OpenBMC versions FW1020.00 through FW1020.60 OpenBMC versions FW1030.00 through FW1030.50 OpenBMC versions FW1050.00 through FW1050.10 Description: A vulnerability in the combination of OpenBMC's default password and session management allows...