2170 matches found
CVE-2024-0168
Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svcoscheck utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to inject arbitrary operating system commands. This vulnerability allows an authenticated attacker to...
Exploit for Code Injection in Oretnom23 Simple_Student_Attendance_System
CVE-2023-51801 Simple Student Attendance System v.1.0 - Mult...
CVE-2023-6994 List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-37932
An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability CWE-22 in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests...
Icegram < 3.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message
Description The Icegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the campaign message field in versions up to, and including, 3.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
MSync <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Description The MSync plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...
CVE-2023-46857
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...
Design/Logic Flaw
Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...
CVE-2023-22522
This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution RCE on an affected instance. Publicly accessible Confluence Da...
Image horizontal reel scroll slideshow < 13.3 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
Up down image slideshow gallery < 12.1 - Authenticated (Subscriber+) SQL Injection via Shortcode
Description The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...
ANAC XML Bandi di Gara <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Description The ANAC XML Bandi di Gara plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-22516
This High severity RCE Remote Code Execution vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code...
CVE-2023-44320
CVE-2023-44320 affects Siemens SCALANCE and RUGGEDCOM devices (e.g., RM1224 LTE EU/NAM, SCALANCE M8xx/MUm/WM/ S-series) with all versions before V7.2.2. The issue is improper authentication validation in the web interface, allowing an authenticated attacker to influence the administrator’s UI. Ex...
Aruba Networks ArubaOS and InstantOS Security Vulnerabilities
Aruba Networks ArubaOS is an operating system for Aruba Mobility-Defined Networks, including Mobility Controllers and Mobility Access Switches from Aruba Networks, Inc. A security vulnerability exists in Aruba Networks ArubaOS and InstantOS that originates from an authenticated denial of service...
CVE-2023-43284
D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary code via an unspecified manipulation of the QoS POST parameter...
CVE-2022-47555
CVE-2022-47555 affects Ormazabal ekorCCP and ekorRCI and is described as an operating system command injection. Multiple sources confirm an authenticated attacker could execute commands, create users with elevated privileges, or backdoor the system. The NVD metrics show a high/critical impact (CV...
Arbitrary file listing and deletion through the CLI
...
PT-2023-4964 · Cisco · Cisco Small Business Rv130W +3
Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to execute arbitrary code on an...