Tormach PathPilot Controller security vulnerabilities

Tormach PathPilot Controller is a series of controllers from Tormach USA. A security vulnerability exists in Tormach PathPilot Controller version v2.9.6. An attacker can exploit the vulnerability to access the G-code shared folder and view sensitive information...

FileBird < 5.6.4 - Author+ Users Folder Deletion

Description The plugin is vulnerable to Insecure Direct Object Reference via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads...

Foxit PDF Reader and Editor Elevation of Privilege Vulnerability

Foxit PDF Reader is a Chinese Foxit Foxit company's a PDF reader.Foxit PDF Editor is a Chinese Foxit Foxit company's a PDF editor Foxit PDF Reader and Editor has an elevation of privilege vulnerability that can be exploited by placing a DLL file in the update-service folder to elevate privileges...

CVE-2024-1569

parisneo/lollms-webui is vulnerable to denial of service through uncontrolled resource consumption. An attacker can trigger repeated unauthenticated POST requests at /open_code_in_vs_code and similar endpoints to repeatedly open VS Code or the default folder opener, exhausting system resources an...

Foxit PDF Reader security vulnerabilities

Foxit PDF Reader is a Chinese Foxit Foxit company's a PDF reader.Foxit PDF Editor is a Chinese Foxit Foxit company's a PDF editor Foxit PDF Reader and Editor has an elevation of privilege vulnerability that can be exploited by placing a DLL file in the update-service folder to elevate privileges...

iTop security vulnerabilities

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 2.7.10, 3.0.4, 3.1.1, and 3.2.0, which stems from the ability to retrieve files in the env-production folder, even though they should have restricted access...

LoLLMs Resource Management Error Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A resource management error vulnerability exists in LoLLMs that originates from allowing an attacker to open Visual Studio Code or the default folder opener multiple times by sending repeated...

CVE-2024-32488: Improper Handling of Insufficient Permissions or Privileges

In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there...

PT-2024-24610 · Foxit · Foxit Pdf Reader/Editor

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader and Editor versions prior to 2024.1 Description: The issue allows Local Privilege Escalation during update checks due to weak permissions on the update-service folder. This weakness enables attackers to place crafted DLL file...

CVE-2024-25907

Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2...

CVE-2024-25908

Missing Authorization vulnerability in JoomUnited WP Media folder.This issue affects WP Media folder: from n/a through 5.7.2...

WordPress Plugin WP Media Folder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in...

WordPress Plugin WP Media Folder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in...

CVE-2024-32001

SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or...

SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...

CVE-2024-1520 OS Command Injection in parisneo/lollms-webui

An OS Command Injection vulnerability exists in the '/opencodefolder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussionid' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to...

Microsoft Windows Compressed Folder Security Vulnerabilities

Microsoft Windows Compressed Folder is an application from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Compressed Folder. An attacker could exploit the vulnerability to remotely execute code. The following products and versions are affected:Windows 11 Version...

CVE-2024-2027: Improper Input Validation

The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-27674: Incorrect Default Permissions

Macro Expert through 4.9.4 allows BUILTIN\Users:OICIM access to the "%PROGRAMFILESX86%\GrassSoft\Macro Expert" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary...

Node.js Module node-tar < 6.2.1 DoS

In the nodejs module node-tar prior to version 6.2.1, there is no validation of the number of folders created while unpacking a file. As a result, an attacker can use a malicious file to exhaust the CPU and memory on the host and crash the nodejs client. Note that Nessus has not tested for these...