CVE-2024-22241

VMware Aria Operations for Networks (formerly vRealize Network Insight) is affected by CVE-2024-22241, a cross-site scripting vulnerability in the login banner that an admin user can abuse to inject code and allegedly take over a user account. Affected product/version: Aria Operations for Network...

CVE-2024-22241

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner and takeover the user account...

CVE-2024-22240

Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information...

CVE-2024-22240

Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information...

CVE-2024-22238

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization...

CVE-2024-22238

CVE-2024-22238 affects VMware Aria Operations for Networks. The vulnerability is a cross-site scripting (XSS) flaw caused by improper input sanitization that could allow a malicious actor with admin privileges to inject code into user profile configurations. Impacted product: Aria Operations for ...

CVE-2023-28063

Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service...

PT-2024-1680 · Unknown · Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: Aria Operations for Networks affected versions not specified Description: The issue is related to a cross-site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile...

PT-2024-1681 · Unknown · Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: Aria Operations for Networks affected versions not specified Description: The issue is related to a cross-site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner, potentially...

PT-2024-1682 · Vmware · Vmware Aria Operations For Networks

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations for Networks affected versions not specified Description: The issue is related to a local file read vulnerability in VMware Aria Operations for Networks. This vulnerability can be exploited by a malicious actor with adm...

Bank Locker Management System SQL Injection

Exploit Title: Bank Locker Management System - SQL Injection Application: Bank Locker Management System Date: 12.09.2023 Bugs: SQL Injection Exploit Author: SoSPiro Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/...

CVE-2023-6165

The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Any authenticated user may obtain private message details from other users on the same instance

Summary Users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message itself, which means any user can just iterate over message ids to loudly obtain all private messages of an...

CVE-2024-23649

Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message...

PT-2024-12039 · Unknown · Processwire

Name of the Vulnerable Software and Affected Versions: ProcessWire version 3.0.210 Description: An issue in ProcessWire allows attackers to execute arbitrary code and install a reverse shell via the download zip url parameter when installing a new module. This issue is disputed as it requires the...

PT-2024-19371 · Elecom · Elecom Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers affected versions not specified Description: The issue allows a network-adjacent attacker with administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. This c...

CVE-2023-6456

The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Citrix Virtual Apps and Desktops RCE (CTX583930)

The version of Citrix Virtual Apps and Desktops installed on the remote Windows host is affected by a remote code execution vulnerability. A remote, authenticated attacker must possess admin privileges to the Session Recording server, if exploited, may result in an authenticated user being able t...

CVE-2024-22409 Default Privileges allow for high level operations for low privileged users in datahub

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR 9067 to...

CVE-2024-22409 Default Privileges allow for high level operations for low privileged users in datahub

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR 9067 to...