Microsoft Azure Marketplace SaaS 访问控制错误漏洞

Microsoft Azure Marketplace SaaS is a marketplace software from Microsoft Corporation USA. An access control error vulnerability exists in Microsoft Azure Marketplace SaaS that stems from improper access control and allows an authorized attacker to disclose information over the network...

PT-2025-25394

Name of the Vulnerable Software and Affected Versions Salt Master affected versions not specified Description The issue allows arbitrary event injection on the Salt Master. An authorized minion can use the master's minion event method to send arbitrary events onto the master's event bus...

CVE-2024-56512

CVE-2024-56512 (Apache NiFi) affects NiFi 1.10.0–2.0.0, where creating a new Process Group omits fine‑grained authorization checks for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers. As a result, authenticated users with permission to create Process Groups ...

Exploit for Path Traversal in Iptanus Wordpress_File_Upload

The script is only intended for authorization system detection...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat

Manual use is cumbersome; create an example script instead. Us...

CVE-2024-11713

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'pageid' parameter of the wpjobportaldeactivate function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...

CVE-2024-42448

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution RCE on the VSPC server machine...

CVE-2024-8272 macOS Universal Audio (UAConnect) <= 2.7.0 - Local Privilege Escalation

The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication IPC. Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to...

CVE-2024-45369

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource...

CVE-2024-45369

CVE-2024-45369 concerns mySCADA myPRO Manager, where a web-application parameter allows unauthorized access due to a weak authentication mechanism. Multiple connected sources corroborate an improper authentication vulnerability affecting myPRO Manager used for visualization/control of industrial ...

AZL-53622 CVE-2024-30896 affecting package influxdb 2.6.1-30

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...

CVE-2024-52506

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included i...

CVE-2024-52506 Graylog can leak other users' reports via concurrent PDF report rendering

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included i...

CVE-2024-52506 Graylog can leak other users' reports via concurrent PDF report rendering

Graylog is a free and open log management platform. The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included i...

GHSA-VGGM-3478-VM5M Graylog concurrent PDF report rendering can leak other users' reports

Impact The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to...

Graylog concurrent PDF report rendering can leak other users' reports

Impact The reporting functionality in Graylog allows the creation and scheduling of reports which contain dashboard widgets displaying individual log messages or metrics aggregated from fields of multiple log messages. This functionality, as included in Graylog 6.1.0 & 6.1.1, is vulnerable to...

CVE-2024-41151

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

CVE-2024-41151

CVE-2024-41151 : Apache HertzBeat (prior to 1.6.1) contains a deserialization of untrusted data vulnerability. The issue can be exploited by authorized users to achieve code execution, with a CVSSv3.1 base score of 8.8 (HIGH) and network access requiring low privileges and no user interaction. Th...

CVE-2024-41151 Apache HertzBeat: RCE by notice template injection vulnerability

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat: before 1.6.1. Users are recommended to upgrade to version 1.6.1, which fixes the issue...

CVE-2024-45505

CVE-2024-45505 concerns Apache HertzBeat (incubating) prior to 1.6.1, where an improper neutralization of special elements enables a Command Injection. The vulnerability affects execution paths that process constructed commands, allowing an attacker with network access (and with low privileges) t...