CVE-2024-11430

CVE-2024-11430 affects the SQL Chart Builder WordPress plugin. Affected component: gv n_schart_2 shortcode arg1 parameter; root cause is insufficient escaping and poor query preparation, enabling SQL Injection. Impact: with Contributor+ authentication, an attacker can append additional SQL to exi...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-8496

Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-11597

Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-11598

Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2, or 2023.3 HF3 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845

CVE-2024-9845 affects Ivanti Automation prior to 2024.4.0.1. The issue is due to insecure permissions, enabling a local authenticated attacker to achieve local privilege escalation. The CVSS is 3.1/3.0-based vectors with a base score of 7.8 (HIGH) and local access requirements. Remediation: upgra...

CVE-2024-10251

Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-10256

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-7572

Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-7572

CVE-2024-7572 affects Ivanti Desktop and Server Management (DSM). The issue arises from insufficient permissions in DSM prior to 2024.3.5740, allowing a local authenticated attacker (low privileges) to delete arbitrary files, with impact rated high (I and A) and local attack vector. A fixed versi...

CVE-2024-7572

Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-8540

Insecure permissions in Ivanti Sentry before versions 9.20.2 and 10.0.2 or 10.1.0 allow a local authenticated attacker to modify sensitive application components...

EUVD-2024-34147

Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

CVE-2024-9844

Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions...

CVE-2024-10256

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files...

CVE-2024-10256

CVE-2024-10256 affects Ivanti Patch SDK. The issue is insufficient permissions in Ivanti Patch SDK before version 9.7.703, enabling a local authenticated attacker to delete arbitrary files. The vulnerability is documented across multiple sources (Red Hat, CNVD, CVE listings) with a CVSSv3.1 base ...

CVE-2024-10256

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files...

CVE-2023-6947

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, whic...

CVE-2024-54198

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2024-54198

CVE-2024-54198 affects SAP NetWeaver Application Server ABAP. In certain conditions, an authenticated attacker can craft a Remote Function Call (RFC) to restricted destinations, exposing credentials for a remote service and potentially allowing complete compromise of that service. Affected compon...