PT-2024-19173 · Ubiquiti · Unifi Switches +3

Name of the Vulnerable Software and Affected Versions: UniFi Access Points versions prior to 6.6.55 UniFi Switches versions prior to 6.6.61 UniFi LTE Backup versions prior to 6.6.57 UniFi Express versions prior to 3.2.5 Description: A malformed discovery packet sent by a malicious actor with...

PT-2024-15009 · WordPress · Infinitewp Client

Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin for WordPress versions up to, and including, 1.12.3 Description: The issue allows unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window ...

Backup Bolt < 1.4.0 - Sensitive Data Exposure

Description The plugin is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information. Access the error log at...

CVE-2023-6565: Insecure Storage of Sensitive Information

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET...

Backup Bolt < 1.4.0 - Sensitive Data Exposure

Description The plugin is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information. PoC Access the error lo...

CVE-2024-1343

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2024-1343

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

Directory traversal

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2024-1343

CVE-2024-1343 concerns LaborOfficeFree, version 19.10. A weak permission in the backup directory (path: %programfiles(x86)% LaborOfficeFree BackUp) allows any authenticated user to read backup files, enabling potential disclosure of backup data. Documents consistently cite an access-control weakn...

CVE-2024-1343 Weak permission vulnerability in LaborOfficeFree

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

CVE-2024-1343 Weak permission vulnerability in LaborOfficeFree

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

PT-2024-3907 · Unknown · Laborofficefree

Name of the Vulnerable Software and Affected Versions: LaborOfficeFree version 19.10 Description: The issue is related to inadequate access control in the backup directory of LaborOfficeFree, allowing any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree...

CVE-2024-1343: Improper Access Control

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfilesx86% LaborOfficeFree BackUp'...

XAMPP - Buffer Overflow Exploit

Exploit Title: XAMPP v3.3.0 — '.ini' Buffer Overflow Unicode + SEH Author: Talson @Ripp3rdoc Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/8.0.28/xampp-windows-x64-8.0.28-0-VS16-installer.exe Version: 3.3.0 Tested on: Windows 11 CVE-2023-46517 \ / \ \ /| | || | /| ||...

LaborOfficeFree Access Control Error Vulnerability

LaborOfficeFree is a free Turnos management and Presencia control software from LaborOfficeFree. An access control error vulnerability exists in LaborOfficeFree version 19.10 that originates from allowing an authenticated user to read backup files in a directory...

How to Move Backup Data for a File Backup or Object Storage Backup to a Different Repository

Purpose This article documents the procedure for migrating backup data created by an unstructured data backup job File Backup or Object Storage Backup from one backup repository to another backup repository so that the job can resume incremental backup operations using the new destination. Soluti...

CVE-2023-40105

In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Directory traversal

Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the downloadbackup.php component...

CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...

CVE-2024-20720 Command injection in data collector backup due to insufficient patching of CVE-2023-38208

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user...