CVE-2024-34315

The content management system CmsEasy version 7.7.7.9 is vulnerable to a local file inclusion (LFI) flaw. The root cause is the improper use of the file_get_contents function within the fckedit_action method of the /admin/template_admin.php file. This vulnerability allows an attacker to read arbi...

CVE-2024-34314

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the filegetcontents function in the fetchaction method of /admin/templateadmin.php. This vulnerability allows attackers to read arbitrary files...

CVE-2024-34315

CmsEasy v7.7.7.9 was discovered to contain a local file inclusion vunerability via the filegetcontents function in the fckeditaction method of /admin/templateadmin.php. This vulnerability allows attackers to read arbitrary files...

CVE-2024-34314

CmsEasy version v7.7.7.9 is susceptible to a local file inclusion vulnerability within the fetch_action method of /admin/template_admin.php. The root cause is the improper use of the file_get_contents function, which allows an attacker to read arbitrary files on the system. To mitigate this risk,...

CVE-2021-34970: Use of Externally-Controlled Format String

Foxit PDF Reader print Method Use of Externally-Controlled Format String Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in...

Code Injection

Apache Hive is vulnerable to Code Injection. The vulnerability is caused by improper sanitization or validation of user-supplied URLs in the openBrowserWindow method within HiveJdbcBrowserClient.java, which allows an authenticated attacker to submit a malicious URL which results in command...

crmeb 安全漏洞

Zhongbang CRMEB is an open source e-commerce management system from Zhongbang Networks Zhongbang in Xi'an, China. A security vulnerability exists in crmebjava v1.3.4, which was discovered via the mergeList method of the com.zbkj.front.pub.ImageMergeController class to contain a server-side reques...

CVE-2024-33118

LuckyFrameWeb version v3.5.2 contains an arbitrary read vulnerability located in the fileDownload method within the com.luckyframe.project.common.CommonController class. This flaw allows for unauthorized reading of data. As a temporary workaround, it is recommended to disable the fileDownload met...

PT-2024-25120 · Unknown · Luckyframeweb

Name of the Vulnerable Software and Affected Versions: LuckyFrameWeb version 3.5.2 Description: The issue is related to an arbitrary read vulnerability. It affects the fileDownload method in the class com.luckyframe.project.common.CommonController. Recommendations: For LuckyFrameWeb version 3.5.2...

CVE-2024-33118

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonController...

CVE-2024-33117

The crmeb_java e-commerce management system (version 1.3.4 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the mergeList method of the com.zbkj.front.pub.ImageMergeController class, which could allow for potential exploitation. As a temporary workaround, it is recomme...

app.cash.lilbitcoinj:lilbitcoinj-core (>=0.0.2, <=0.0.3), app.cash.lninvoice:ln-invoice (>=0.0.1, <=0.0.6) +1351 more potentially affected by CVE-2024-34447 via org.bouncycastle:bcprov-jdk15to18 (>=1.63, <=1.77)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.63, =0.0.2, =0.0.1, =0.2.9, =0.1.0, =0.2.1, =0.2.0, =1.0.0, =1.0.1-rc14, =0.2.0, =0.2.0, =1.0.0.release, =1.0.20.release - cn.hermesdi:api-crypto-spring-boot-starter 1.0.0.release and more Source cves: CVE-2024-34447 Source advisory:...

CVE-2024-27453

In Extreme XOS through 22.6.1.4, a read-only user can escalate privileges to root via a crafted HTTP POST request to the python method of the Machine-to-Machine Interface MMI...

CVE-2023-51595

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The...

CVE-2023-51595

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The...

CVE-2023-51591

Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this...

CVE-2023-51591

Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this...

CVE-2023-51584

Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in...

CVE-2023-51584

Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. User interaction is required to exploit this vulnerability in...

CVE-2023-51582

Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. Th...