CVE-2024-36509

An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted password...

Exploit for CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscri...

WordPress Styler for Ninja Forms plugin <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license vulnerability

Authenticated Subscriber+ Arbitrary Option Deletion via deactivatelicense vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Styler for Ninja Forms versions = 3.3.4...

CVE-2024-10672

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...

CVE-2024-10538 Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the beforelabel parameter in the Image Comparison widget in all versions up to, and including, 3.12.5 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2024-8773 · Intel +1 · Intel Vpl +1

Name of the Vulnerable Software and Affected Versions: Intel VPL versions prior to 24.1.4 Description: The issue is related to improper buffer restrictions in Intel VPL software, which may allow an authenticated user to potentially enable escalation of privilege via local access. This is due to t...

PT-2024-8519 · Fortinet · Fortimanager +2

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer-BigData before 7.4.0 Description: The issue is related to improper neutralization ...

PT-2024-8717 · Siemens · Sinec Nms

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V3.0 SP1 Description: A vulnerability has been identified in the affected application, which contains a database function that does not properly restrict the permissions of users to write to the filesystem of the...

CVE-2024-10770

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level...

WordPress Top Store theme <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation vulnerability

Authenticated Subscriber+ Arbitrary Plugin Installation/Activation vulnerability discovered by WordFence in WordPress Theme Top Store versions = 1.5.4...

CVE-2024-10839

Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity XXE in the Management option...

PT-2024-35173 · Amazon · Alldata

Name of the Vulnerable Software and Affected Versions: Amazon data.all versions =2.6.0 Description: An authenticated data.all user can manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not be able to fetch by...

WordPress Prime Slider - Addons For Elementor plugin <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget vulnerability

WordPress Prime Slider - Addons For Elementor plugin = 3.15.18 - Authenticated Contributor+ Stored Cross-Site Scripting via Blog Widget vulnerability discovered by Robert DeVore in WordPress Plugin Prime Slider – Addons For Elementor versions = 3.15.18...

CVE-2024-20532

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20534

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 6800, 7800, and 8800 Series, and Cisco Video Phone 8875 with Cisco Multiplatform Firmware could allow an authenticated, remote attacker to conduct stored cross-site scripting XSS attacks against users. This vulnerabilit...

CVE-2024-20514

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This...

CVE-2024-9307

The mFolio Lite plugin for WordPress is vulnerable to file uploads due to a missing capability check in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute...

Cisco IP Phone 跨站脚本漏洞

The Cisco IP Phone is a hardware device from Cisco, Inc. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from a cross-site scripting vulnerability that stems from the affected device's WebUI not properly validating user-supplied input. An authenticated, remote attacker cou...

WordPress MapPress Maps for WordPress plugin <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Map Block vulnerability discovered by Akbar Kustirama in WordPress Plugin MapPress Maps for WordPress versions = 2.94.1...

WordPress mFolio Lite plugin <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files vulnerability

Missing Authorization to Authenticated Author+ File Upload via EXE and SVG Files vulnerability discovered by Francesco Carlucci in WordPress Plugin mFolio Lite versions = 1.2.1...