CVE-2023-45793

CVE-2023-45793 : Affected product is Siemens Siveillance Control (versions 2.8 up to 3.1.1). The issue is an authorization check failure related to the list of access groups assigned to a user, allowing a locally logged-on user to gain write privileges to objects they should only read. The vulner...

Cross site request forgery (csrf)

The LadiApp plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the publishlp function hooked via an AJAX action in versions up to, and including, 4.4. This makes it possible for unauthenticated attackers to change the LadiPage key a key fully controll...

CVE-2023-4728

CVE-2023-4728 concerns the LadiApp WordPress plugin. The issue is a missing capability check in publish_lp(), exposed via an AJAX action, allowing authenticated users with subscriber-level access or higher to modify the LadiPage key and create pages. This can enable stored XSS by pages created th...

CVE-2023-4626

The CVE-2023-4626 entry affects the LadiApp WordPress plugin, where a missing capability check in ladiflow_save_hook() enables data modification by authenticated users with subscriber-level access or higher. The vulnerability is noted in versions up to and including 4.3, allowing updates to the l...

CVE-2023-4731

CVE-2023-4731 relates to the LadiApp plugin for WordPress. The Red Hat and WordPress Threat Intel entries confirm a CSRF vulnerability in versions up to 4.4 caused by a missing nonce check in init_endpoint(), wired through the init hook. This allows unauthenticated attackers to forge requests tha...

CVE-2023-4628

The CVE-2023-4628 case concerns the LadiApp WordPress ladipage plugin. A missing nonce check in ladiflow_save_hook() (versions ≤ 4.4) enables unauthenticated attackers to forge requests and update the ladiflow_hook_configs option, potentially convincing an admin to perform actions. Affected produ...

Input validation

An unauthenticated remote attacker can read memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

Remote code execution

An unauthenticated remote attacker can perform a remote code execution due to an origin validation error. The access is limited to the service user...

Design/Logic Flaw

An unauthenticated remote attacker can DoS the control agent due to a out-of-bounds read which may prevent or disrupt the charging functionality...

Input validation

An unauthenticated remote attacker can write memory out of bounds due to improper input validation in the MQTT stack. The brute force attack is not always successful because of memory randomization...

Input validation

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files...

Command injection

An unauthenticated remote attacker can perform a command injection in the OCPP Service with limited privileges due to improper input validation...

Input validation

An unauthenticated remote attacker can perform a log injection due to improper input validation. Only a certain log file is affected...

Input validation

An unauthenticated remote attacker can upload a arbitrary script file due to improper input validation. The upload destination is fixed and is write only...

Input validation

An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service...

Directory traversal

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability is exploited, a use...

CVE-2024-1328

The Newsletter2Go WordPress plugin is affected by CVE-2024-1328: stored XSS via the style parameter in all versions up to 4.0.13. Exploitation requires authentication (subscriber access or higher) and can inject scripts that execute when a user visits an injected page. Technical details about a p...

CVE-2024-27279

CVE-2024-27279 describes a directory traversal vulnerability in a-blog cms affecting multiple release branches: 3.1.x (up to 3.1.9), 3.0.x (up to 3.0.30), 2.11.x (up to 2.11.59), 2.10.x (up to 2.10.51), and 2.9 and earlier. A user with editor or higher privileges who can log in may obtain arbitra...

Sql injection

SQL injection vulnerability in Employee Management System v.1.0 allows a local attacker to obtain sensitive information via a crafted payload to the txtemail parameter in the login.php...

CVE-2024-26005

CVE-2024-26005 affects the PHOENIX CONTACT CHARX SEC series (e.g., CHARX SEC-3000/3050/3100/3150). The public descriptions state that an unauthenticated remote attacker can gain service‑level privileges due to an incomplete cleanup during service restart after a DoS. Red Hat and CNNVD corroborate...