CVE-2024-4157

CVE-2024-4157 covers a PHP Object Injection vulnerability in the WordPress plugin “Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder.” All versions up to and including 5.1.15 are affected via deserialization in the extractDynamicValues function. Exploitation re...

CVE-2024-4157 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-31394

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

CVE-2024-30420

Server-side request forgery SSRF vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain...

CVE-2024-30420

Server-side request forgery SSRF vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain...

CVE-2024-31394

Vulnerability : CVE-2024-31394 in a-blog cms. A directory traversal flaw allows an authenticated user with editor or higher privileges to obtain arbitrary server files. Affected versions : 3.1.x before 3.1.12, 3.0.x before 3.0.32, 2.11.x before 2.11.61, 2.10.x before 2.10.53, and 2.9 and earlier....

CVE-2024-30420

CVE-2024-30420 is an SSRF flaw in a-blog cms affecting the 3.0.x (prior to 3.0.32) and 3.1.x (prior to 3.1.12) series. The vulnerability allows a user with administrator or higher privileges who can log in to the product to obtain arbitrary files on the server and access internal server informati...

Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additiona...

Important: pmix security update

The Process Management Interface PMI provides process management functions for MPI implementations. PMI Exascale PMIx provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fixes: pmix: race condition allows attacker...

CVE-2024-22275

The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data...

CVE-2024-22275

CVE-2024-22275 affects VMware vCenter Server and is a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell can exploit it to read arbitrary sensitive data from files, with Confidentiality impact rated High and other impacts not affected....

VMware vCenter Server 安全漏洞

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A security vulnerability exists in VMware...

Local File Inclusion (LFI)

gregwar/rst is vulnerable to Local File Inclusion LFI. The vulnerability is due to inadequate input validation, allowing an attacker to manipulate file paths to read arbitrary files...

PT-2024-4036 · Ivanti · Ivanti Neurons For Itsm

Name of the Vulnerable Software and Affected Versions: Ivanti Neurons for ITSM affected versions not specified Description: The issue is related to an unrestricted file upload vulnerability in the web component of Ivanti Neurons for ITSM. This vulnerability allows a remote, authenticated,...

The vulnerability of Telit Cinterion modem’s microprogramming software lies in the use of files and directories accessible from external parties, allowing a perpetrator to gain access to read and write arbitrary files (or directories) within the system.

The vulnerability of Telit Cinterion modem’s microprogramming software lies in the use of files and directories accessible to external parties. Exploiting this vulnerability can allow a hacker to gain access to and read/write arbitrary files or directories within the system...

CVE-2024-3812

CVE-2024-3812 affects Salient Core for WordPress up to version 2.0.7, enabling Local File Inclusion via the nectar_icon shortcode (icon_linea attribute). Exploitation requires authenticated access at contributor level or higher, potentially allowing arbitrary PHP file execution and data access. P...

CVE-2024-3810

CVE-2024-3810 : The Salient Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.5.3 via the icon/image attribute used in shortcodes. Authenticated attackers with contributor-level permissions or higher can include and execute arbitrary PHP f...