18147 matches found
CVE-2023-5775 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password
The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.0.2. This is due to to the plugin improperly storing backup destination passwords in plaintext. This makes it possible for authenticated attackers, with...
CVE-2023-5775
CVE-2023-5775 : BackWPup for WordPress stores backup destination passwords in plaintext in all versions up to 4.0.2. The root cause is plaintext storage of credentials, enabling an authenticated administrator to retrieve the password from the UI or the options table. Remediation: upgrade to a ver...
CVE-2024-22988
ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp...
Design/Logic Flaw
An issue in zkteco zkbio WDMS v.8.0.5 allows an attacker to execute arbitrary code via the /files/backup/ component...
PT-2024-19634 · Zkteco · Zkteco Zkbio Wdms
Name of the Vulnerable Software and Affected Versions: zkteco zkbio WDMS version 8.0.5 Description: An issue in the software allows an attacker to execute arbitrary code via the "/files/backup/" component. Recommendations: For zkteco zkbio WDMS version 8.0.5, consider restricting access to the...
CVE-2024-22988: Improper Control of Generation of Code
ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp...
CVE-2024-22988
The ZKBio WDMS software (versions prior to 9.0.2 Build 20250526 , including specific mentions of v.8.0.5 ) is vulnerable to a design/logic flaw in the /files/backup/ component. An attacker can exploit this by downloading database backups because the filenames are based on a predictable timestamp ...
ZKTeco ZKBio WDMS Security Vulnerability
ZKTeco ZKBio WDMS is a web-based data system from ZKTeco, China. A security vulnerability exists in ZKTeco ZKBio WDMS version v.8.0.5. An attacker can exploit this vulnerability to execute arbitrary code via the /files/backup/ component...
Dell PowerProtect Data Manager Operating System Command Injection Vulnerability
Dell PowerProtect Data Manager PPDM is a set of data protection solutions from Dell USA. The product supports features such as data backup, virtual machine backup and database protection. An operating system command injection vulnerability exists in Dell PowerProtect Data Manager version 19.15 an...
[SECURITY] Fedora 38 Update: rear-2.7-8.fc38
Relax-and-Recover is the leading Open Source disaster recovery and system migration solution. It comprises of a modular frame-work and ready-to-go workflows for many common situations to produce a bootable image and restore from backup using this image. As a benefit, it allows to restore to...
[SECURITY] Fedora 39 Update: rear-2.7-8.fc39
Relax-and-Recover is the leading Open Source disaster recovery and system migration solution. It comprises of a modular frame-work and ready-to-go workflows for many common situations to produce a bootable image and restore from backup using this image. As a benefit, it allows to restore to...
CVE-2023-6565 InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET...
Design/Logic Flaw
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express Only Mesh Mode, Router mode is not affected...
CVE-2024-22054
Ubiquiti UniFi networking hardware is vulnerable to a design/logic flaw (CWE-20) caused by improper input validation . A malicious actor with preexisting network access can send a malformed discovery packet to disrupt device management and discovery functionalities. Affected products include UniF...
CVE-2024-22054
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express Only Mesh Mode, Router mode is not affected...
CVE-2024-22054
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express Only Mesh Mode, Router mode is not affected...
LockBit, the world’s worst ransomware, is down
For the last two years the absolute worst, most prolific, most globally significant "big game" ransomware gang has been LockBit. This evening its position as ransomwares biggest beast is suddenly in doubt, following some non-consensual website redecoration at the hands of the UKs National Crime...
CVE-2024-22054: Improper Input Validation
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express Only Mesh Mode, Router mode is not affected...
PT-2024-19173 · Ubiquiti · Unifi Switches +3
Name of the Vulnerable Software and Affected Versions: UniFi Access Points versions prior to 6.6.55 UniFi Switches versions prior to 6.6.61 UniFi LTE Backup versions prior to 6.6.57 UniFi Express versions prior to 3.2.5 Description: A malformed discovery packet sent by a malicious actor with...
PT-2024-15009 · WordPress · Infinitewp Client
Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin for WordPress versions up to, and including, 1.12.3 Description: The issue allows unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window ...