CVE-2024-5035

CVE-2024-5035 affects TP-Link Archer C4500X (firmware up to 1_1.1.6). The rftest binary launches a network listener on TCP ports 8888, 8889, and 8890, exposing a route for unauthenticated command injection that leads to arbitrary command execution with elevated privileges. The flaw’s root cause i...

CVE-2024-5035 TP-Link Archer C5400X - RFTest Unauthenticated Command Injection

The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Node.js Vulnerability Details CVEID:CVE-2024-25180 DESCRIPTION: pdfmake could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input. By...

BIT-NODE-2024-21892

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this...

Unspecified Vulnerability in IBM Security Guardium (CNVD-2024-24936)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium has a security vulnerability that ste...

The vulnerability of the Windows Common Log File System (CLFS) driver in Windows operating systems allows a hacker to gain elevated privileges.

The vulnerability of the Windows Common Log File System CLFS driver in Windows operating systems is related to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

CVE-2024-4662

The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as...

CVE-2024-4662 Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution

The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as...

CVE-2024-4662

CVE-2024-4662 (Oxygen Builder for WordPress) : Affects all versions up to 4.8.2. Root cause is storing data in post metadata without an underscore prefix, allowing lower-privilege users (e.g., contributors) to inject arbitrary PHP code via the WordPress UI and gain elevated privileges, resulting ...

CVE-2024-4662 Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution

The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as...

WordPress plugin Pet Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2024-27264

IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 284563...

Cisco Firepower Management Center Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not adequately...

Vulnerability fixed in QlikSense Enterprise

A vulnerability has been fixed in QlikSense Enterprise. A malicious person can exploit the vulnerability to grant themselves elevated privileges, potentially executing arbitrary code on the system on which QlikSense is installed. For successful misuse, the malicious party must have prior...

CentOS 8 : libX11 (CESA-2024:2973)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2973 advisory. - A vulnerability was found in libX11 due to a boundary condition within the XkbReadKeySyms function. This flaw allows a local user to trigger an...

PT-2024-21780 · Ibm · Ibm Performance Tools For I

Name of the Vulnerable Software and Affected Versions: IBM Performance Tools for i versions 7.2 through 7.5 Description: The issue allows a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator...

Veeam Backup Enterprise Manager 安全漏洞

Veeam Backup Enterprise Manager is a centralized management and monitoring tool from Veeam USA. A security vulnerability exists in Veeam Backup Enterprise Manager that originates from allowing an elevated privilege user to read backup session logs...

Oxygen Builder < 4.8.3 - Authenticated (Contributor+) Remote Code Execution

Description The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users,...

WordPress Plugin Survey Maker 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-27417

A flaw was discovered in the Linux kernel's IPv6 implementation, specifically within the inet6rtmgetaddr function. The issue arises when user space provides a valid IFATARGETNETNSID value but omits the IFAADDRESS and IFALOCAL attributes. In such cases, the function returns an -EINVAL error while...