CVE-2024-4454

CVE-2024-4454 affects WithSecure Elements Endpoint Protection . The flaw is in the WithSecure plugin hosting service : an attacker can abuse a symbolic link to create a file and escalate privileges to SYSTEM . It is a local vulnerability requiring administrator interaction , with high impact. Doc...

CVE-2024-4454 WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to...

CVE-2024-4454 WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to...

kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...

Fortinet FortiWeb Arbitrary file read through command line pipe (FG-IR-21-218)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-218 advisory. - An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter o...

CVE-2024-4454: Improper Link Resolution Before File Access

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to...

PT-2024-31167 · Withsecure · Withsecure Elements Endpoint Protection

Name of the Vulnerable Software and Affected Versions: WithSecure Elements Endpoint Protection affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part o...

Video Station Command Injection

The vulnerability of the Video Station photo album creation application relates to the failure to take measures to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Dell PowerProtect Data Manager Arbitrary Action

The vulnerability of the microprogramming software of the Dell PowerProtect Data Manager DM5500 exists due to the lack of measures taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Cacti displaySettings XSS

The vulnerability of the displaySettings function in the Cacti network monitoring software relates to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a malicious actor to execute cross-site scripting using forged cookie files...

CVE-2023-37888 WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0...

AutoGPT Code Execution

The vulnerability of the artificial intelligence tool AutoGPT exists due to the failure to address the issue of neutralizing specific elements used in the operating system’s command line. Exploiting this vulnerability allows a hacker to execute arbitrary code when using an instance of AutoGPT wit...

CVE-2024-3126

CVE-2024-3126 concerns the parisneo/lollms-webui project, specifically the bug in the Python file lollms_xtts.py and the function run_xtts_api_server. The issue stems from constructing an OS command with a Python f-string and passing xtts_base_url to subprocess.Popen without adequate input saniti...

CVE-2024-4702

The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2024-4702

CVE-2024-4702 refers to a Stored Cross-Site Scripting flaw in the Mega Elements – Addons for Elementor WordPress plugin. The issue arises in the Button widget, due to insufficient input sanitization and output escaping on user-supplied attributes, enabling an attacker with contributor-level acces...

CVE-2024-4702 Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

WordPress Mega Elements plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Button Widget vulnerability discovered by stealthcopter in WordPress Plugin Mega Elements versions = 1.2.1...

WordPress Mega Elements Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Mega Elements Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4702 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ecd07d502745 Credits stealthcopter Required...

CVE-2024-4702: Improper Neutralization of Input During Web Page Generation

The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

WordPress plugin Mega Elements 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...