CVE-2024-21938

Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager SCCM installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

CVE-2024-21938

Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager SCCM installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution...

CVE-2024-21938

Summary: CVE-2024-21938 concerns the AMD Management Plugin for Microsoft System Center Configuration Manager (SCCM). The root cause is incorrect default permissions in the SCCM installation directory, which could let a low-privilege attacker escalate privileges and potentially achieve arbitrary c...

AMD Management Plugin 安全漏洞

AMD Management Plugin is a plugin for IT administrators using Microsoft System Center Configuration Manager SCCM from UltraMicroelectronics AMD. A security vulnerability exists in AMD Management Plugin that stems from incorrect default permissions. An attacker could exploit the vulnerability to...

AMD Management Plugin for SCCM Incorrect Default Permissions Vulnerability

Bulletin ID: AMD-SB-9005 Potential Impact: Incorrect Default Permissions Leading to Arbitrary Execution Severity: High Summary An incorrect default permissions vulnerability is identified within the AMD Management Plugin for the Microsoft® System Center Configuration Manager SCCM. The plugin is...

PT-2024-19121 · Microsoft +1 · System Center Configuration Manager +1

Name of the Vulnerable Software and Affected Versions: AMD Management Plugin for Microsoft System Center Configuration Manager SCCM versions prior to 7.0.0.1318 Description: The issue is related to incorrect default permissions in the AMD Management Plugin for the Microsoft System Center...

CVE-2024-51988 HTTP API's queue deletion endpoint does not verify that the user has a required permission

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the configure permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HT...

CVE-2024-51988 HTTP API's queue deletion endpoint does not verify that the user has a required permission

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the configure permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HT...

CVE-2024-51988 HTTP API's queue deletion endpoint does not verify that the user has a required permission

RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not verifying the configure permission of the user. Users who had all of the following: 1. Valid credentials, 2. Some permissions for the target virtual host & 3. HT...

CVE-2024-51988

CVE-2024-51988 affects RabbitMQ: queue deletion via the HTTP API could bypass the configure permission, allowing users with credentials, some vhost permissions, and HTTP API access to delete queues they should not. Affected versions include Open Source RabbitMQ up to 3.12.10 (fixed in 3.12.11) an...

Insecure Direct Object Reference (IDOR)

jweiland/events2 is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to missing access checks in the management plugin, which allows an attacker to activate or delete events without authentication...

events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability

An issue was discovered in the events2 aka Events 2 extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference IDOR vulnerability with the potential to activate or delete various events for unauthenticated user...

GHSA-CCHP-3RQ6-69WJ events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability

An issue was discovered in the events2 aka Events 2 extension before 8.3.8 and 9.x before 9.0.6 for TYPO3. Missing access checks in the management plugin lead to an insecure direct object reference IDOR vulnerability with the potential to activate or delete various events for unauthenticated user...

pgAdmin 8.3 Remote Code Execution Exploit

pgAdmin versions 8.3 and below have a path traversal vulnerability within their session management logic that can allow a pickled file to be loaded from an arbitrary location. This can be used to load a malicious, serialized Python object to execute code within the context of the target...

Wp-Insert 跨站脚本漏洞

Wp-Insert is an ad management plugin. A cross-site scripting vulnerability exists in Wp-Insert version 2.0.8, which stems from the presence of unknown functions that lead to cross-site scripting...

CVE-2022-1609

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site...

CVE-2023-26531

Cross-Site Request Forgery CSRF vulnerability in 闪电博 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 allows Cross Site Request Forgery.This issue affects 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条: from n/a through 4.2.7...

CVE-2022-47430 WordPress The School Management – Education & Learning Management Plugin <= 4.1 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Management – Education & Learning Management: from n/a through 4.1...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Joseph C Dolson My Content Management plugin = 1.7.6 versions...

Openfire Authentication Bypass / Remote Code Execution Exploit

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...