16894 matches found
CVE-2024-3070
The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known...
DEBIAN-CVE-2024-25641
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web...
CVE-2024-27946
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.5. Downloading files overwrites files with the same name in the installation directory of the affected systems. The filename for the target file can be specified, thus arbitrary files can be overwritten by an attacker with...
CVE-2024-27946
CVE-2024-27946 affects Siemens RUGGEDCOM CROSSBOW (all versions before V5.5). The issue is a path traversal/file download weakness that lets an attacker overwrite arbitrary files in the installation directory by supplying a target filename, given the attacker has the required privileges. Affected...
CVE-2024-27939
CVE-2024-27939 affects Siemens RUGGEDCOM CROSSBOW prior to version V5.5. The issue is missing authorization that allows an unauthenticated user to upload arbitrary files, enabling potential remote arbitrary code execution with system privileges. Public sources (Red Hat/Red Hat support and ICS adv...
CVE-2024-3809
The Porto Theme – Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the ‘slideshowtype’ post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...
CVE-2024-27827
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to read arbitrary files...
CVE-2024-27827
CVE-2024-27827 affects macOS Sonoma 14.5 focusing on the Finder component. The issue allows an app with local access to read arbitrary files, and Apple states it was addressed through improved state management and fixed in macOS Sonoma 14.5. The public documentation does not provide additional te...
CVE-2024-27827
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.5, macOS Ventura 13.6.7. An app may be able to read arbitrary files...
[SECURITY] [DSA 5688-1] atril security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5688-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 12, 2024 https://www.debian.org/security/faq -...
RHEL 7 : systemd (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary file...
RHEL 6 : netkit-rsh (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server CVE-2019-7283 - In NetKit...
CVE-2024-4413
The CVE-2024-4413 entry concerns the Hotel Booking Lite plugin for WordPress, vulnerable to unauthenticated PHP Object Injection (deserialization) up to version 4.11.1. The vulnerability could allow an attacker to inject a PHP object; while no POP chain is known in the plugin itself, a POP chain ...
CVE-2024-3808
CVE-2024-3808 pertains to the Porto Theme – Functionality plugin for WordPress. The vulnerability enables authenticated attackers with contributor-level privileges or higher to perform a Local File Inclusion via the porto_portfolios shortcode and its portfolio_layout attribute, enabling arbitrary...
CVE-2024-3070
CVE-2024-3070 affects the WordPress plugin Last Viewed Posts by WPBeginner (vulnerable up to 1.0.0). It allows unauthenticated PHP Object Injection via deserialization of the LastViewedPosts cookie. The vendor notes no known POP chain publicly; however, if a POP chain exists via another plugin or...
CVE-2024-3806 Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in...
CVE-2024-3806 Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'portoajaxposts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in...
CVE-2024-4441 XML Sitemap & Google News <= 5.4.8 - Unauthenticated Local File Inclusion
The XML Sitemap & Google News plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.8 via the 'feed' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any P...
Directory Traversal
cherryPy is vulnerable to Directory Traversal. The vulnerability is due to insufficient input validation by utilizing .. sequences within the staticfilter component, which allows remote attackers to read arbitrary files...
