8199 matches found
REDCap 安全漏洞
REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a lack of sufficient input validation of the Project Dashboard name field, making it vulnerable to a stored cross-site...
REDCap 安全漏洞
REDCap is a data collection and management web application from REDCap Open Source. A security vulnerability exists in REDCap 15.0.0 and earlier versions, which stems from a lack of cross-site request forgery protection in the logout functionality, which allows an attacker to trigger a logout...
CVE-2024-56312
A stored cross-site scripting XSS vulnerability in the Project Dashboard name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a user clicks on the project Dashboard name, the crafted payload is executed, potentially...
CVE-2024-52589
Discourse CVE-2024-52589 involves an authorization issue where moderators can view the Screened emails list in the admin dashboard and learn users’ emails. Multiple sources flag this as a vulnerability in Discourse with the fix being applied in the latest versions; where upgrade is not possible, ...
PT-2024-35385 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user...
WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Simple Dashboard versions = 2.0...
WordPress Custom Dashboard Widget plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Custom Dashboard Widget versions = 1.0.0...
CVE-2024-56085
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection...
CVE-2024-56087
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading to Server-Side Template Injection...
Logpoint 安全漏洞
Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.5.0. An attacker could exploit the vulnerability to inject a payload while in the Search Template Dashboard...
PT-2024-36714 · Logpoint · Logpoint
Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: The issue allows authenticated users to inject payloads while querying the Search Template Dashboard. These payloads are executed, leading to Server-Side Template Injection. Recommendations: For...
CVE-2024-56085
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection...
CVE-2024-56085
Vulnerability overview (CVE-2024-56085) : Logpoint versions before 7.5.0 expose a Server-Side Template Injection (SSTI) in the process of creating a Search Template Dashboard . Authenticated users can inject payloads that are executed on the server side, indicating a flaw in the template renderin...
CVE-2024-10783
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the registersite function in all versions up to, and including, 5.2 when a site is left in an unconfigured stat...
CVE-2024-53245
In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...
CVE-2024-53245
In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...
CVE-2024-53245 Information Disclosure due to Username Collision with a Role that has the same Name as the User
In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard...
CVE-2024-53245
CVE-2024-53245 affects Splunk Enterprise and Splunk Cloud Platform where a low-privilege user whose username matches a role with read access to dashboards can clone a dashboard and view its name and XML. Affected versions are Splunk Enterprise < 9.3.0, < 9.2.4, and < 9.1.7, and Splunk Cl...
CVE-2024-10708
The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server...
CVE-2024-11107
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks...