688 matches found
CVE-2024-47863
An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22.10.26. A stored XSS was found in the user configuration contact name field. This form is only accessible to authenticated users with...
CVE-2024-47863
An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22.10.26. A stored XSS was found in the user configuration contact name field. This form is only accessible to authenticated users with...
CVE-2024-47863
An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, and 22.10.x before 22.10.26. A stored XSS was found in the user configuration contact name field. This form is only accessible to authenticated users with...
CVE-2024-9478
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2...
CVE-2024-9479
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2...
CVE-2024-9479
CVE-2024-9479 affects upKeeper Instant Privilege Access prior to 1.2. The root cause is improper privilege management, enabling privilege escalation with HIGH impact to confidentiality, integrity, and availability (per CVSS 4.0). Exploitation details are not provided in the sources. Remediation: ...
CVE-2024-9479
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper Instant Privilege Access: before 1.2...
Improper Access Control
Umbraco is vulnerable to Improper Access Control. The vulnerability is due to insufficient restrictions on API access and is caused by improper access control in the webhook API, allows low-privilege users to retrieve information that should be accessible only to users with settings section...
Lack of proper access control on endpoint to delete evaluators
Description The /v1/evaluators/ route allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. The current implementation: Does not...
CVE-2024-39753
An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Patches Will be patched in 14.3.1 and 15.0.0. Workarounds...
CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...
PT-2024-31750 · Centreon · Centreon Bi Server
Name of the Vulnerable Software and Affected Versions: Centreon BI Server versions 24.04.x through 24.04.2 Centreon BI Server versions 23.10.x through 23.10.7 Centreon BI Server versions 23.04.x through 23.04.10 Centreon BI Server versions 22.10.x through 22.10.10 Description: An issue was...
PT-2024-8624 · Cisco · Cisco Nexus Dashboard Fabric Controller
Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard Fabric Controller NDFC versions affected versions not specified Description: The issue is related to a lack of authorization in the implementation of the Cisco NDFC platform's application programming interface. This coul...
PT-2024-32273 · Trend Micro · Trend Micro Deep Discovery Inspector
Name of the Vulnerable Software and Affected Versions: Trend Micro Deep Discovery Inspector versions 5.8 and above Description: A vulnerability in Trend Micro Deep Discovery Inspector could allow an attacker to disclose sensitive information from affected installations. The attacker must first...
CVE-2024-37990
A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....
CVE-2024-34653
Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege...
Improper Authorization
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization. An attacker can gain access to minor information by sending crafted requests with low privileges. Remediation Upgrade magento/community-edition to...
Improper Authorization
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization. An attacker can gain access to minor information by bypassing security restrictions using a low-privileged account. Remediation Upgrade...