17606 matches found
CVE-2024-24741
CVE-2024-24741 affects SAP Master Data Governance for Material Data across versions 618, 619, 620, 621, 622, 800, 801, 802, 803, 804. Reported root cause: missing authorization checks for authenticated users, enabling privilege escalation. Impact stated as potential read of some sensitive informa...
CVE-2024-24740
CVE-2024-24740 affects SAP NetWeaver Application Server (ABAP) — specifically kernel versions 7.53–7.94 and KRNL64UC 7.53. The issue is an information-disclosure vulnerability caused by insufficient protection of internal data, allowing an attacker to access information that could be restricted. ...
Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over
Exploit Title: Lost and Found Information System v1.0 - idor leads to Account Take over Date: 2023-12-03 Exploit Author: OR4NG.M4N Category : webapps CVE : CVE-2023-38965 Python p0c : import argparse import requests import time parser = argparse.ArgumentParserdescription='Send a POST request to t...
CVE-2024-0166
creationtimestamp| type| source ---|---|--- 2024-02-12 20:26:48+00:00| seen| https://t.me/ctinow/183372 2025-05-06 21:21:36+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15226...
CVE-2022-34309
IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229440...
CVE-2024-22230
Dell Unity contains a Cross-site Scripting (XSS) vulnerability in versions prior to 5.4. The issue arises from inadequate protection of the web page structure, allowing an authenticated attacker to steal session information, masquerade as the affected user, perform actions the user can, or genera...
CVE-2024-1420
Rejected reason: REJECT This is a duplicate of CVE-2024-1049. Please use CVE-2024-1049 instead...
CVE-2023-41703
CVE-2023-41703 affects Open-Xchange App Suite. The flaw arises from inadequate sanitization of User ID references at mentions in document comments, allowing script code to be injected into a user session when handling a malicious document. The issue is mitigated by applying provided updates/patch...
CVE-2024-25711
CVE-2024-25711 affects diffoscope before 256. The vulnerability arises from trusting the gpg --use-embedded-filenames option, enabling directory traversal via an embedded filename in a GPG file. Exploitation would disclose contents of arbitrary files (e.g., ../.ssh/id_rsa). Impact is information ...
CVE-2024-0594
CVE-2024-0594 affects the WordPress plugin Awesome Support (WPAS) for WordPress. The vulnerability is a union-based SQL Injection in the wpas_get_users action, exploitable via the q parameter due to insufficient escaping and poor query preparation. Authenticated attackers with subscriber-level ac...
CVE-2023-6884
creationtimestamp| type| source ---|---|--- 2024-02-09 21:17:11+00:00| seen| https://t.me/ctinow/182243...
Juniper Support Portal Exposed Customer Device Info
Until earlier this week, the support website for networking equipment vendor Juniper Networks was exposing potentially sensitive information tied to customer products, including which devices customers bought, as well as each products warranty status, service contracts and serial numbers. Juniper...
Exploit for Improper Restriction of XML External Entity Reference in Ivanti Connect_Secure
CVE-2024-22024 Check for CVE-2024-22024 vulnerability in Ivant...
CVE-2024-25148
CVE-2024-25148 affects Liferay Portal versions 7.2.0–7.4.1 and certain Liferay DXP/older unsupported releases. The vulnerability stems from leakage of the doAsUserId URL parameter when creating linked content with the WYSIWYG editor and while impersonating a user, enabling remote authenticated us...
CVE-2024-22012
CVE-2024-22012 : A Google Pixel-related out-of-bounds write due to a missing bounds check can lead to local privilege escalation without user interaction. Affected component: Pixel bootloader (per Pixel Update Bulletin).CVSS shows LOCAL access, LOW exploit complexity, and HIGH confidentiality/int...
CVE-2024-22021
Vulnerability CVE-2024-22021 affects Veeam Recovery Orchestrator products in limited older branches: Recovery Orchestrator 6, Disaster Recovery Orchestrator 5, and Availability Orchestrator 4. A low-privileged Plan Author can retrieve plans from a Scope other than their assigned one. Root cause d...
CVE-2023-42765
CVE-2023-42765 affects Westermo Lynx Lynx 206-F2G devices. The vulnerability is a cross-site scripting (XSS) in the SNMP configuration where an attacker could inject arbitrary JavaScript via the username parameter in the web interface. Affected product/firmware context is primarily Westermo Lynx ...
CVE-2023-40544
CVE-2023-40544 affects Westermo Lynx 206-F2G (Lynx model, firmware 4.24) and is described as cross-site scripting/cross-origin issues with cleartext transmission of sensitive information over TCP. The public description confirms an attacker with network access could sniff TCP traffic to obtain se...
CVE-2024-23344
CVE-2024-23344 describes an information-disclosure risk in Tuleap where, during a multi-user permission validation, some users could access restricted information (e.g., contents of artifacts or email notifications). The issue is categorized as an authorization/bypass-type disclosure affecting Tu...
