17917 matches found
CVE-2024-45786
This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive...
Cisco IOS XR 安全漏洞
Cisco IOS XR is a set of operating systems developed by Cisco USA for its network devices. A security vulnerability exists in Cisco IOS XR that stems from the software running as a Docker container on hardware supported by the Cisco IOS XR software, which could allow an authenticated, remote...
CVE-2024-5416: Improper Neutralization of Input During Web Page Generation
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied...
Cisco IOS XR 安全漏洞
Cisco IOS XR is a set of operating systems developed by the U.S.-based Cisco for its network devices. A security vulnerability exists in Cisco IOS XR, which stems from a flaw in the way configuration files are stored that could allow an authenticated, local, low-privilege attacker to obtain Mongo...
IBM MQ Operator Security Bypass Vulnerability
IBM MQ Operator is a tool from International Business Machines IBM for managing the lifecycle of IBM MQ Queue Manager. A security bypass vulnerability exists in IBM MQ Operator versions 2.0.26 and 3.2.4, which can be exploited by an authenticated attacker in a specifically defined role to...
CVE-2019-25212: Improper Neutralization of Special Elements used in an SQL Command
The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2024-45327: Improper Restriction of Excessive Authentication Attempts
An improper authorization vulnerability CWE-285 in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTT...
PT-2024-18650 · Cisco · Cisco Ios Xr
Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system...
CVE-2024-44107
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution...
CVE-2024-44103
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to escalate their privileges...
CVE-2024-44105
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to obtain OS credentials...
CVE-2024-44107
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution...
CVE-2024-44107
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution...
CVE-2024-44107
Ivanti Workspace Control is affected by DLL hijacking in the management console, enabling local privilege escalation and arbitrary code execution. The CVE-2024-44107 issue impacts Workspace Control up to version 2025.2 (10.19.0.0); remediation is to upgrade to 2025.2 (10.19.0.0) or apply the vend...
CVE-2024-44105
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to obtain OS credentials...
CVE-2024-44105
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to obtain OS credentials...
CVE-2024-44103
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 10.19.0.0 allows a local authenticated attacker to escalate their privileges...
CVE-2024-44103
Ivanti Workspace Control is affected by DLL hijacking in the management console prior to version 2025.2 (10.19.0.0). A locally authenticated attacker can escalate privileges due to an insecure DLL search path. Public sources corroborate that affected versions include 10.18.0.0 and earlier, with e...
TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities
RISK EVALUATION TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs. 2. RECOMMENDED PRACTICES Upgrade to TopQuadrant TopBraid...
