2299 matches found
PT-2024-3250 · Oracle +1 · Virtualbox +1
Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to an out-of-bounds write vulnerability in the Core component of Oracle VM VirtualBox. This vulnerability can be easily exploited by a low-privileged attacker wit...
CVE-2024-2500
The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and...
The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of cloud-based data storage software for IBM Watson CP4D Data Stores lies in the lack of encryption measures for protected data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2024-1685 Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and...
TTLock Security Vulnerability
TTLock is a smart lock. The TTLock App suffers from a security vulnerability that stems from virtual keys and settings being deleted only on the client side, allowing an attacker to access the lock after deletion...
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in the storage of passwords in a recoverable format, which allows an attacker to disclose the protected information.
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the storage of passwords in a recoverable format. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...
CVE-2024-1854 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for...
Microsoft Windows Kernel 安全漏洞
The Microsoft Windows Kernel is the kernel of the Windows operating system from the American company Microsoft. An information disclosure vulnerability exists in Microsoft Windows Kernel, which can be exploited by an attacker to obtain the value of a registry entry...
SAP NetWeaver Information Disclosure Vulnerability
SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An information disclosure vulnerability exists in SAP NetWeaver that arises from allowing an attacker to access...
Microsoft Teams Security Vulnerability
Microsoft Teams is a software from Microsoft USA for online meetings, chat, and cloud storage features. A security vulnerability exists in Microsoft Teams for Android. An attacker exploiting the vulnerability could gain access to sensitive information...
kubevirt-csi: PersistentVolume allows access to HCP's root node
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane HCP. This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node...
CVE-2023-5457
A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application due to the “debug” configuration parameter set to “True” allows a remote unauthenticated attacker to access critical information and have other unspecified impacts to t...
CVE-2024-22889
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...
Sql injection
The Conversios – Google Analytics 4 GA4, Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the eesyncProductCategory function using the parameters conditionData, valueData, productArray, exclude and include in all versions ...
The vulnerability of the Scalefusion MDM Agent, a software tool for managing endpoints, stems from deficiencies in access control. This vulnerability allows a malicious individual to escape from the isolated software environment.
The vulnerability of the Scalefusion MDM Agent software management tool is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to gain access to the isolated software environment...
CVE-2023-42835
A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1. An attacker may be able to access user data...
Design/Logic Flaw
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive...
Code injection
The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords. This issue affects ERP XL...
The vulnerability of the XWiki platform, caused by deficiencies in the authentication process, allows unauthorized users to gain access to protected information.
The vulnerability of the XWiki platform stems from deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...