Slivery Extender <= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode

Description The Slivery Extender plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the 'sliderthemesection' function. This is due to the use of calluserfunc on one of the shortcode attributes. This makes it possible for authenticated...

CVE-2024-26296: Improper Neutralization of Special Elements used in a Command

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...

CVE-2024-22544: Improper Neutralization of Special Elements used in a Command

An issue was discovered in Linksys Router E1700 version 1.0.04 build 3, allows authenticated attackers to execute arbitrary code via the setDateTime function...

PT-2024-19477 · Linksys · Linksys Router E1700

Name of the Vulnerable Software and Affected Versions: Linksys Router E1700 version 1.0.04 build 3 Description: An issue was discovered in the Linksys Router E1700, allowing authenticated attackers to execute arbitrary code via the setDateTime function. Recommendations: For Linksys Router E1700...

CVE-2024-1889: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device...

Brizy – Page Builder < 2.4.41 - Authenticated (Contributor+) Arbitrary File Upload

Description The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to...

Academy LMS – eLearning and online course solution for WordPress < 1.9.20 - Authenticated (Subscriber+) Privilege Escalation

Description The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saveduserinfo function. This makes it...

CVE-2023-52155: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via the sauvegardes variable through the /admin/sauvegarde/run.php endpoint...

CVE-2024-1236: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Filterable Controls label icon parameter in all versions up to, and including, 5.9.8 due to insufficient input sanitization...

CVE-2024-21682: Improper Control of Generation of Code

This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 all versions. Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or...

CVE-2024-1510: Improper Neutralization of Input During Web Page Generation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sutooltip shortcode in all versions up to, and including, 7.0.2 due to insufficient input sanitization and output escaping on user supplied attributes and user supplie...

CVE-2024-24741: Missing Authorization

SAP Master Data Governance for Material Data - versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804, does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to read some sensitive information but no impact ...

CVE-2023-6815: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a...

CVE-2024-0167

Dell Unity (unified hybrid storage array) is affected by CVE-2024-0167 prior to version 5.4. The vulnerability is an OS command injection in the svc_topstats utility that an authenticated, local attacker can exploit to overwrite arbitrary files on the filesystem with root privileges. Impact is hi...

CVE-2024-0168

Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svcoscheck utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to inject arbitrary operating system commands. This vulnerability allows an authenticated attacker to...

CVE-2024-22221: Improper Neutralization of Special Elements used in an SQL Command

Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information...

CVE-2024-22228: Improper Neutralization of Special Elements used in an OS Command

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svccifssupport utility. An authenticated attacker could potentially exploit this vulnerability, escaping the restricted shell and execute arbitrary operating system commands with root privileges...

CVE-2024-0167: Improper Neutralization of Special Elements used in an OS Command

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svctopstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges...

CVE-2024-22225: Improper Neutralization of Special Elements used in an OS Command

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svcsupportassist utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges...

CVE-2023-40264: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows authenticated path traversal in the user interface...