18615 matches found
CVE-2024-10763
CVE-2024-10763 affects the WordPress Campress theme (versions up to 1.35). The vulnerability is a Local File Inclusion via the function campress_woocommerce_get_ajax_products, allowing unauthenticated attackers to include and execute arbitrary PHP files on the server, potentially bypassing access...
CVE-2025-23190
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...
The vulnerability of the d_status.asp component of the D-Link DIR-816A router’s microprogramming system allows a intruder to gain unauthorized access to protected information.
The vulnerability of the dstatus.asp component of the D-Link DIR-816A2 router’s microprogramming system is related to the disclosure of information. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially...
CVE-2025-0516
Removed by vendor...
CVE-2025-0516 Incorrect Authorization in GitLab
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data...
WordPress plugin LTL Freight Quotes SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...
The vulnerability of the File Parser component in macOS operating systems allows a perpetrator to gain unauthorized access to confidential data.
The vulnerability of the File Parser component in macOS operating systems is related to the unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data...
Vulnerabilities fixed in Microsoft Office
Microsoft has fixed vulnerabilities in several Office products. A malicious party can exploit the vulnerabilities to grant themselves elevated privileges, access sensitive data and execute arbitrary code with the victim's privileges. Successful exploitation requires the malicious party to trick t...
CVE-2024-13843
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...
CVE-2024-13843
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data...
Apple ordered to grant access to users’ encrypted data
Last week, an article in the Washington Post revealed the UK had secretly ordered Apple to provide blanket access to protected cloud backups around the world. Since then, privacy focused groups have uttered their objections. The UK government has demanded to be able to access encrypted data store...
Vulnerabilities fixed in F5 BIG-IP
F5 has fixed vulnerabilities in BIG-IP. A malicious party could exploit the vulnerabilities to launch attacks that could lead to the following categories of damage: - Denial-of-Service DoS. - Circumvention of a security measure - Execution of arbitrary code Root/admin - Execution of arbitrary cod...
CVE-2025-23190
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...
CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...
CVE-2025-23190
CVE-2025-23190 affects SAP NetWeaver/ABAP platform (ST-PI). The root cause is a missing authorization check that allows an authenticated attacker to call a remote-enabled function module and access data they normally cannot view. The attacker cannot modify data or affect system availability as de...
The vulnerability of the Java VM component of the Oracle Database Server management system allows a hacker to gain access to read data or modify data.
The vulnerability of the Java VM component of the Oracle Database Server management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain read access to data or modify data using network packets...
CVE-2024-57178
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...
macOS 14.x < 14.4 Multiple Vulnerabilities (120895)
The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.4. It is, therefore, affected by multiple vulnerabilities: - The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, tvO...
CVE-2024-57178
An SQL injection vulnerability exists in Stock-Forecaster =01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio endpoint, it is possible to trigger an SQL injection in the application. As a result, the attacker will be able the user data or manipulate the software...
The vulnerability of the Security component of the Oracle Communications Order and Service Management system allows a perpetrator to gain read, modify, add, or delete access to data, or cause a partial service disruption.
The vulnerability of the Security component of the Oracle Communications Order and Service Management system is related to a data source validation error. Exploiting this vulnerability may allow an attacker, operating remotely, to gain read, modify, add, or delete access to data, or cause a parti...