11671 matches found
PT-2024-18000 · WordPress · Yuki Theme
Name of the Vulnerable Software and Affected Versions: Yuki theme for WordPress versions up to, and including, 1.3.13 Description: The issue allows authenticated attackers with subscriber-level access and above to reset the theme's settings due to a missing capability check on the reset customize...
PT-2024-17158 · WordPress · Brizy – Page Builder
Name of the Vulnerable Software and Affected Versions: The Brizy – Page Builder plugin for WordPress versions up to, and including, 2.4.39 Description: The issue allows authenticated attackers with contributor-level access and above to upload files to arbitrary locations on the server via the id...
PT-2024-18219 · Unknown · Tie Secure Relay
Name of the Vulnerable Software and Affected Versions: TIE Secure Relay affected versions not specified Description: A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for...
PT-2024-3141
Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to, and including, 2.6.1 Description The issue is related to a SQL Injection vulnerability due to insufficient protection of the SQL query structure when handling the question id parameter. This allows a remote attacker t...
PT-2024-5200 · NetGear · Netgear Prosafe Network Management System
Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: The issue is related to the getFilterString method in the NETGEAR ProSAFE Network Management System, which lacks proper validation of a user-supplied strin...
PT-2024-15961 · WordPress · Imagerecycle
Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.13 Description: The issue allows authenticated attackers with subscriber-level access and above to modify data without authorization due to a missing...
Zyxel ATP Security Vulnerability
The Zyxel ATP is a firewall from China's Heqin Zyxel. A security vulnerability exists in Zyxel ATP firmware versions 4.32 through 5.37 Patch 1, which originates from a vulnerability that could allow an authenticated attacker to execute certain operating system commands on the affected device via...
CVE-2024-1343
A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...
PT-2024-21061 · Iris-Web · Iris-Web
Name of the Vulnerable Software and Affected Versions: iris-web versions prior to 2.4.0 Description: A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations. The vulnerability may allow an attacker to inject malicious scripts into the...
YetiForceCrm Security Vulnerability
YetiForceCrm is an open source Crm system from the Polish company YetiForce. A security vulnerability exists in YetiForce YetiForceCRM 6.4.0 and earlier versions, which originates from a vulnerability that allows an authenticated, remote attacker to obtain sensitive information via the license...
PT-2024-19961 · F5 · F5Os Qkview Utility
Name of the Vulnerable Software and Affected Versions: F5OS QKView utility affected versions not specified Description: A directory traversal vulnerability exists in the F5OS QKView utility, allowing an authenticated attacker to read files outside the QKView directory. Note that software versions...
4ipnet EAP-767 Security Vulnerability
The 4ipnet EAP-767 is an enterprise-grade concurrent dual-band 802.11ac indoor access point designed for high-density environments such as offices, universities, hotels and hospitals. A security vulnerability exists in the 4ipnet EAP-767 version v3.42.00, which originates from a web interface tha...
CVE-2024-22226
Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svcsupportassist utility. An authenticated attacker could potentially exploit this vulnerability, to gain unauthorized write access to the files stored on the server filesystem, with elevated privileges...
PT-2024-2797 · Dell · Dell Unity
Name of the Vulnerable Software and Affected Versions: Dell Unity versions prior to 5.4 Description: The issue is related to a lack of protection of the SQL query structure in the Dell Unity Operating Environment, which can be exploited by an authenticated attacker to expose sensitive information...
PT-2024-2826 · Mitsubishi · Melsec Iq-R Series Safety Cpu +1
Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions Description: The issue is related to an Incorrect Privilege Assignment vulnerability that allows a remote...
CVE-2023-40264
An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface...
CVE-2023-40263
An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated command injection via ftp...
CVE-2023-40355
Cross Site Scripting XSS vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions...
CVE-2023-47209
A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to...