CVE-2024-39607

OS command injection vulnerability exists in ELECOM wireless LAN routers. A specially crafted request may be sent to the affected product by a logged-in user with an administrative privilege to execute an arbitrary OS command...

PT-2024-25648 · Elecom · Elecom Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers affected versions not specified Description: The issue allows for the unrestricted upload of files with dangerous types in ELECOM wireless LAN routers. A specially crafted file can be uploaded by a logged-in user...

The vulnerability of the IBM i operating system and the IBM Rational Development Studio for i application suite lies in the insufficient protection of registration data, allowing a hacker to execute arbitrary code with administrator privileges.

The vulnerability of the IBM i operating system and the IBM Rational Development Studio for i application suite is related to insufficient protection of registration data. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code with administrator privileges...

PT-2024-29127 · Elecom · Elecom Wrc-X1500Gsa-B +1

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-X6000XS-G/WRC-X1500GS-B/WRC-X1500GSA-B versions up to 1.11 Description: A cross-site request forgery issue exists in ELECOM wireless LAN routers. When a user with administrative privileges views a malicious page while logged in to...

CVE-2024-3083

A “CWE-352: Cross-Site Request Forgery CSRF” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page...

PT-2024-23626 · Unknown · Plug&Track Sensor Net Connect V2

Name of the Vulnerable Software and Affected Versions: Plug&Track Sensor Net Connect V2 version 2.24 Description: A Cross-Site Request Forgery CSRF issue can be exploited by remote attackers to perform state-changing operations with administrative privileges. This is done by luring authenticated...

Aero CMS 0.0.1 Cross Site Request Forgery

============================================================================================================================================= | Title : Aero CMS v0.0.1 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 64 bits | | Vendor...

CVE-2024-7297 Langflow Privilege Escalation

Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint...

ELECOM WRC-X6000XS-G、WRC-X1500GS-B和WRC-X1500GSA-B 安全漏洞

ELECOM WRC-X6000XS-G and others are a wireless router from ELECOM Japan. A security vulnerability exists in the ELECOM WRC-X6000XS-G, WRC-X1500GS-B, WRC-X1500GSA-B v1.11 and earlier versions, which originates from viewing a malicious page while logged in to an affected product with administrative...

ELECOM WRC-X6000XS-G、WRC-X1500GS-B和WRC-X1500GSA-B 安全漏洞

ELECOM WRC-X6000XS-G and others are a wireless router from ELECOM Japan. A security vulnerability exists in the ELECOM WRC-X6000XS-G, WRC-X1500GS-B, and WRC-X1500GSA-B v1.11 and earlier versions, which stems from the possibility that a logged in user with administrative privileges could send a...

PT-2024-38245 · Langflow · Langflow

Name of the Vulnerable Software and Affected Versions: Langflow versions prior to 1.0.13 Description: The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint. Recommendations: For Langflow version...

PT-2024-37784 · WordPress · Paritypress – Parity Pricing With Discount Rules

Name of the Vulnerable Software and Affected Versions: The ParityPress – Parity Pricing with Discount Rules plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

CVE-2024-4447

In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...

PT-2024-28787 · Sl Base +1 · Sl Base +6

Name of the Vulnerable Software and Affected Versions: Solar-Log 1000 versions prior to v2.8.2 and build 52- 23.04.2013 Solar-Log 250, 300, 1200, 2000, SL 50 Gateway versions prior to 4.2.8 SL Base versions prior to 5.1.2 and 6.0.0 Description: The issue is related to incorrect access control,...

PT-2024-31161

Name of the Vulnerable Software and Affected Versions Software versions prior to 24.07.12 Software versions 23.01.20 LTS through 23.01.19 LTS Software versions 23.10.24v13 LTS and earlier Software versions 24.04.24v5 LTS and earlier Description The issue arises in the System → Maintenance tool,...

PT-2024-27926 · R Hub · R-Hub Turbomeeting

Name of the Vulnerable Software and Affected Versions: R-HUB TurboMeeting versions prior to 9.x Description: A command-injection issue in the Certificate Signing Request CSR functionality allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying...

CVE-2024-6231

The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

The vulnerability of the corporate version of the GitHub Enterprise Server, related to the improper implementation of authentication algorithms, allows a perpetrator to gain full administrative privileges and access to the system.

The vulnerability of the corporate version of the GitHub Enterprise Server is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the system with administrator privileges...

PT-2024-37812 · WordPress · Reglevel

Name of the Vulnerable Software and Affected Versions: RegLevel plugin for WordPress versions up to, and including, 1.2.1 Description: The issue allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts in pages due to insufficient input...

FUJITSU Network Edgiot GW1500 vulnerable to path traversal

Overview FUJITSU Network Edgiot GW1500 M2M-GW for FENICS provided by Fujitsu Limited contains a path traversal vulnerability CWE-22. Eddy HUYNH & Jonathan PAUC from LCIE - BUREAU VERITAS CPS reported this vulnerability to Fujitsu Limited and coordinated. After the coordination was completed,...