CVE-2024-25006

XenForo before 2.2.14 allows Directory Traversal with write access by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import...

Security Bulletin: IBM Common Licensing using IBM® SDK, Java™ Technology Edition vulnerable to CVEs

Summary Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition in IBM License Key Server Administration and Reporting Tool ART and Administration Agent. For more information please refer to Oracle's CPU Advisory and the X-Force database entries referenced below. Vulnerability Details...

CVE-2024-24721

An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...

CVE-2024-24721

An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...

Open Redirect

com.liferay.portal, release.dxp.bom is vulnerable to Open Redirect. The vulnerability is caused due to allowing user supplied input in URLs as a redirect target and not sanitizing the user supplied input in the adaptive media administration page. This allows remote attackers to redirect users to...

QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

cmseasy Security Vulnerabilities

CmsEasy is a content management system CMS for creating responsive websites from China's Kyushu Ecommerce Technology CmsEasy. A security vulnerability exists in cmseasy version V7.7.7.9, which originates from an arbitrary file deletion vulnerability in lib/admin/templateadmin.php...

GHSA-3MRR-CW9Q-727M Liferay Vulnerable to Open Redirect via Adaptive Media Administration Page

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allows remote attackers to redirect users to arbitrary external URLs via the comliferayadaptivemediawebportletAMPortletredirect parameter...

PT-2024-13188 · Liferay · Liferay Dxp

Name of the Vulnerable Software and Affected Versions: Liferay DXP versions 7.4 GA through update 92 Liferay DXP 2023.Q3 before patch 6 Description: The issue allows remote attackers to redirect users to arbitrary external URLs via the com liferay adaptive media web portlet AMPortlet redirect...

The vulnerability of the /admin/info/properties component of the Apache Solr search server, which allows a hacker to disclose protected information

The vulnerability of the /admin/info/properties component of the Apache Solr search server is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2023-47218: QNAP QTS and QuTS Hero Unauthenticated Command Injection (FIXED)

Rapid7 has identified an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry- and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numero...

The vulnerability of the system administration program Sudo, related to deficiencies in the authentication process, allows attackers to escalate their privileges.

The vulnerability of the system administration program Sudo is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to increase their privileges...

QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi

There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage NAS devices, and QuTS hero is a core part of the firmware for numerous QNAP...

PT-2024-2061 · Pixelfed · Pixelfed

Name of the Vulnerable Software and Affected Versions: Pixelfed versions 0.10.4 through 0.11.9 Description: The issue arises from improper and insufficient authorization checks when processing requests, allowing attackers to access more functionality than intended, including administrative and...

How 3 Million ‘Hacked’ Toothbrushes Became a Cyber Urban Legend

Plus: China’s Volt Typhoon hackers lurked in US systems for years, the Biden administration’s crackdown on spyware vendors ramps up, and a new pro-Beijing disinformation campaign gets exposed...

CVE-2023-40262

An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site Scripting XSS in the administration component via Access Request...

kernel: refcount leak in ctnetlink_create_conntrack()

A memory leak problem was found in ctnetlinkcreateconntrack in net/netfilter/nfconntracknetlink.c in the Linux Kernel. This issue may allow a local attacker with CAPNETADMIN privileges to cause a denial of service DoS attack due to a refcount overflow...

CVE-2024-22388

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

Design/Logic Flaw

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-22388 Insecure Default Initialization of Resource in HID Global

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...