CVE-2024-5147

The WPZOOM Addons for Elementor Templates, Widgets plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.37 via the 'gridstyle' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server,...

CVE-2024-4157

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for...

CVE-2024-5147

CVE-2024-5147 : The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to unauthenticated Local File Inclusion via the grid_style parameter in all versions up to and including 1.1.37. The vulnerability allows including and executing arbitrary PHP files on the serv...

CVE-2024-4157

CVE-2024-4157 covers a PHP Object Injection vulnerability in the WordPress plugin “Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder.” All versions up to and including 5.1.15 are affected via deserialization in the extractDynamicValues function. Exploitation re...

CVE-2024-4157 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-35162

Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...

CVE-2024-31394

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier versions. If this...

CVE-2024-30420

Server-side request forgery SSRF vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain...

CVE-2024-30420

Server-side request forgery SSRF vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may obtain...

CVE-2024-31394

Vulnerability : CVE-2024-31394 in a-blog cms. A directory traversal flaw allows an authenticated user with editor or higher privileges to obtain arbitrary server files. Affected versions : 3.1.x before 3.1.12, 3.0.x before 3.0.32, 2.11.x before 2.11.61, 2.10.x before 2.10.53, and 2.9 and earlier....

CVE-2024-30420

CVE-2024-30420 is an SSRF flaw in a-blog cms affecting the 3.0.x (prior to 3.0.32) and 3.1.x (prior to 3.1.12) series. The vulnerability allows a user with administrator or higher privileges who can log in to the product to obtain arbitrary files on the server and access internal server informati...

Contact Form Plugin by Fluent Forms < 5.1.16 - Contributor+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the extractDynamicValues function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additiona...

Important: pmix security update

The Process Management Interface PMI provides process management functions for MPI implementations. PMI Exascale PMIx provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fixes: pmix: race condition allows attacker...

CVE-2024-22275

The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data...

CVE-2024-22275

CVE-2024-22275 affects VMware vCenter Server and is a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell can exploit it to read arbitrary sensitive data from files, with Confidentiality impact rated High and other impacts not affected....

VMware vCenter Server 安全漏洞

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A security vulnerability exists in VMware...

Local File Inclusion (LFI)

gregwar/rst is vulnerable to Local File Inclusion LFI. The vulnerability is due to inadequate input validation, allowing an attacker to manipulate file paths to read arbitrary files...

The vulnerability of Telit Cinterion modem’s microprogramming software lies in the use of files and directories accessible from external parties, allowing a perpetrator to gain access to read and write arbitrary files (or directories) within the system.

The vulnerability of Telit Cinterion modem’s microprogramming software lies in the use of files and directories accessible to external parties. Exploiting this vulnerability can allow a hacker to gain access to and read/write arbitrary files or directories within the system...