231584 matches found
CVE-2024-2061
CVE-2024-2061 affects SourceCodester Petrol Pump Management Software 1.0. The vulnerability is a SQL injection in the /admin/edit_supplier.php file caused by manipulating the id parameter, with remote exploitation reported. Multiple sources confirm impact on confidentiality, integrity, and availa...
CVE-2024-2060
SourceCodester Petrol Pump Management Software 1.0 contains a SQL injection vulnerability in /admin/app/login_crud.php triggered by manipulating the email parameter. The issue enables remote exploitation and has been publicly disclosed (VDB-255375). Multiple sources corroborate the file and vecto...
Cross site scripting
A Cross-Site Scripting XSS vulnerability has been found in HelpDeskZ affecting version 2.0.2 and earlier. This vulnerability could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take control of an authenticated user's browser session...
CVE-2024-2059
CVE-2024-2059 pertains to SourceCodester Petrol Pump Management Software 1.0, where an unrestricted file upload is possible via /admin/app/service_crud.php when handling the photo parameter. The root cause is manipulation of the photo argument that enables remote, unauthenticated uploads (as desc...
CVE-2024-2057
CVE-2024-2057 affects LangChain langchain_community 0.0.26, specifically the TFIDFRetriever’s load_local in libs/community/langchain_community/retrievers/tfidf.py. The vulnerability enables server-side request forgery (SSRF) and is exploitable remotely; public disclosure exists. Upgrading to 0.0....
Design/Logic Flaw
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...
CVE-2024-26280
Apache Airflow prior to 2.8.2 has an information-disclosure issue where authenticated Ops and Viewers can see audit-log contents (e.g., dag names, usernames not visible to them). Version 2.8.2+ fixes default audit-log permissions (Ops/Viewers no longer have access by default; admins retain access...
CVE-2024-22457
CVE-2024-22457 affects Dell Secure Connect Gateway 5.20. The vulnerability arises in the SRS to SCG update path due to improper authentication, allowing a remote low-privileged attacker to impersonate the server by presenting a fake self-signed certificate when communicating with the remote serve...
Design/Logic Flaw
The NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugins for WordPress are vulnerable to unauthorized access of data due to a missing capability check on the downloadtoolssettings function in all versions up to, and including,...
CVE-2024-2058
CVE-2024-2058 affects SourceCodester Petrol Pump Management Software 1.0. The vulnerability is in the /admin/app/product.php file, where manipulating the photo parameter enables unrestricted file upload. The issue is exploitable remotely, and multiple sources indicate the exploit has been disclos...
CVE-2024-1120
CVE-2024-1120 affects NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce on WordPress. The flaw is a missing capability check in download_tools_settings() across all versions up to 2.17.0, allowing unauthenticated attackers to export ...
Remote code execution
The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution...
CVE-2024-0692
SolarWinds Security Event Manager (SEM) is affected by CVE-2024-0692 due to a deserialization of untrusted data in the AMF mechanism, enabling unauthenticated remote code execution on adjacent networks. Public sources in connected documents confirm an unauthenticated RCE condition with a high imp...
Open redirect
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Cross site request forgery (csrf)
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection...
Open redirect
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Path traversal
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product...
Server side request forgery (ssrf)
Server-Side Request Forgery SSRF vulnerability in sirv.Com Image Optimizer, Resizer and CDN – Sirv.This issue affects Image Optimizer, Resizer and CDN – Sirv: from n/a through 7.2.0...
CVE-2024-1859
CVE-2024-1859 refers to the Slider Responsive Slideshow – Image slider, Gallery slideshow WordPress plugin. The vulnerability is a PHP Object Injection in versions up to and including 1.3.8, triggered by deserialization of untrusted input in the awl_slider_responsive_shortcode function. With cont...