PT-2024-19054 · Unknown · Mc Lr Router

Name of the Vulnerable Software and Affected Versions: MC LR Router version 2.10.5 Description: An OS command injection vulnerability exists in the web interface configuration upload functionality. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an...

PT-2024-22220 · Unknown · Mc Lr Router

Name of the Vulnerable Software and Affected Versions: MC LR Router version 2.10.5 Description: The issue concerns OS command injection vulnerabilities in the web interface I/O configuration functionality. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can...

WordPress Grid View Gallery plugin <= 1.0 - Authenticated (Editor+) PHP Object Injection vulnerability

Authenticated Editor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Grid View Gallery versions = 1.0...

WordPress SuevaFree Essential Kit plugin <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin SuevaFree Essential Kit versions = 1.1.3...

WordPress Include Mastodon Feed plugin <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Include Mastodon Feed versions = 1.9.5...

CVE-2024-10126

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7 allows an authenticated user to read server local files of a limited set of filetypes via document preview...

PT-2024-16594 · WordPress · Sirv

Name of the Vulnerable Software and Affected Versions: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress versions up to, and including, 7.3.0 Description: The issue is related to insufficient validation on the filename parameter of the sirv upload file by chunks function, allowing...

PT-2024-22850 · Kasda · Kasda Linksmart Router Kw6512

Name of the Vulnerable Software and Affected Versions: Kasda LinkSmart Router KW6512 versions = v1.3 Description: The issue is related to Multiple OS Command Injection vulnerabilities. An authenticated remote attacker can execute arbitrary OS commands via various cgi parameters. Recommendations:...

PT-2024-16091 · WordPress · Beds24 Online Booking

Name of the Vulnerable Software and Affected Versions: Beds24 Online Booking plugin for WordPress versions up to, and including, 2.0.26 Description: The issue is related to Stored Cross-Site Scripting via the plugin's beds24-link shortcode due to insufficient input sanitization and output escapin...

Drupal core 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Wayne Eaker in WordPress Core Drupal versions 8.0.0-10.2.10,10.3.0-10.3.8,11.0.0-11.0.7...

PT-2024-16799 · M Files · M-Files Aino

Name of the Vulnerable Software and Affected Versions: M-Files Aino versions prior to 24.10 Description: The issue is related to improper access control, allowing an authenticated user to access object information due to an incorrect calculation of effective permissions. Recommendations: For...

WordPress Parallax Image plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via position Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Parallax Image versions = 1.9...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM, Inc. that uses generative AI to help manage complex cloud-native applications. A security vulnerability exists in versions prior to IBM Concert 1.0.3, which stems from allowing authenticated users to access sensitive information...

PT-2024-35493 · Veritas · Veritas Enterprise Vault

Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.1 UPD882911 Description: An issue allows an authenticated remote attacker to inject a parameter into an HTTP request, enabling Cross-Site Scripting XSS while viewing archived content. This could...

CVE-2024-10614 Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancelimport function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

WordPress Real 3D FlipBook plugin <= 4.8 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Aitor F kr0no in WordPress Plugin Real 3D FlipBook versions = 4.6...

WordPress WP Video Robot plugin <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update vulnerability

Authenticated Subscriber+ Privilege Escalation via User Meta Update vulnerability discovered by Tonn in WordPress Plugin WordPress Video Robot - The Ultimate Video Importer versions = 1.20.0...

WordPress SVGPlus plugin <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin SVGPlus versions = 1.1.0...

CVE-2021-1491

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

CVE-2022-20656

A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the system. This vulnerability is due...