ZOHO ManageEngine ADAudit Plus 安全漏洞

ZOHO ManageEngine ADAudit Plus is used by ZOHO to simplify auditing, demonstrate compliance and detect threats. A security vulnerability exists in ZOHO ManageEngine ADAudit Plus version 8110 and prior versions, which stems from vulnerability to authenticated SQL injection attacks in a file audit...

WordPress Element Pack Elementor Addons plugin <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titletag vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Element Pack Elementor Addons versions = 5.7.6...

WordPress Element Pack Elementor Addons plugin <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Webbernaut in WordPress Plugin Element Pack Elementor Addons versions = 5.7.2...

CVE-2024-7560 News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection

The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the newsflashpostmeta meta value. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PH...

Camaleon CMS Directory Traversal CVE-2024-46987

Exploits CVE-2024-46987, an authenticated directory traversal vulnerability in Camaleon CMS versions use auxiliary/gather/camaleon/downloadprivatefile msf undefineddownloadprivatefile show actions ...actions... msf undefineddownloadprivatefile set ACTION msf undefineddownloadprivatefile show...

PT-2024-38442 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this...

WordPress Accept Stripe Payments plugin <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via acceptstripepaymentng Shortcode vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Stripe Payments versions = 2.0.86...

WordPress Modern Events Calendar Lite plugin <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery vulnerability

Authenticated Subscriber+ Server Side Request Forgery vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar Lite versions = 7.12.1...

WordPress plugin Modern Events Calendar 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

CVE-2024-7564

Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The specif...

WordPress Cooked Plugin <= 1.8.0 - Authenticated (Subscriber+) Persistent Cross-Site Scripting via Shortcode vulnerability

Authenticated Subscriber+ Persistent Cross-Site Scripting via Shortcode vulnerability discovered by re-alter in WordPress Plugin Cooked versions = 1.8.0...

WordPress WPBakery plugin <= 7.7 - Authenticated (Author+) Local File Inclusion vulnerability

Authenticated Author+ Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin WPBakery Page Builder versions = 7.7...

WordPress Blox Page Builder plugin <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Blox Page Builder versions = 1.0.65...

CVE-2024-6117

A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file...

CVE-2024-38321

IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868...

CVE-2024-6872

The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor & Gutenberg Blocks! – TemplateSpare plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

WordPress Spectra Pro plugin <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Block IDs vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Spectra Pro versions = 1.1.4...

WordPress Blog2Social plugin <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Blog2Social versions = 7.5.4...

WordPress Element Pack Pro plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL vulnerability

AuthenticatedContributor+ Stored Cross-Site Scripting via Wrapper Link URL vulnerability discovered by Francesco Carlucci in WordPress Plugin Element Pack Pro versions = 7.9.0...

WordPress Formidable Forms plugin <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Formidable Forms versions = 6.11.1...