UBUNTU-CVE-2024-36587

Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting the binary dnscrypt-proxy...

WordPress plugin Floating Chat Widget security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-4924

The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-22261 SQL Injection in Harbor scan log API

SQL-Injection in Harbor allows priviledge users to leak the task IDs...

CVE-2024-29848

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM...

Ivanti Neurons Security Breach

Ivanti Neurons is a groundbreaking platform from US-based Ivanti that simplifies and automates IT systems. A security vulnerability exists in Ivanti Neurons for ITSM that stems from an unrestricted file upload vulnerability in the Web component that allows remote, authenticated, and highly...

PT-2024-36493 · Alkacon · Opencms

Name of the Vulnerable Software and Affected Versions: Alkacon's OpenCMS version 16 Description: Two Cross-Site Scripting issues have been discovered in Alkacon's OpenCMS, which could allow a user with sufficient privileges to create and modify web pages through the admin panel to execute malicio...

python: Path traversal on tempfile.TemporaryDirectory

A flaw was found in the tempfile.TemporaryDirectory class in python3/cpython3. The class may dereference symbolic links during permission-related errors, resulting in users that run privileged programs being able to modify permissions of files referenced by the symbolic link...

CVE-2024-29852

Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...

CVE-2024-29852

Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...

CVE-2024-29852

Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs...

PT-2024-23085

Name of the Vulnerable Software and Affected Versions Veeam Backup Enterprise Manager affected versions not specified Description The issue allows high-privileged users to read backup session logs. There is no information provided about the estimated number of potentially affected devices worldwi...

CVE-2024-35204

Veritas System Recovery before 23.3Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks...

IBM QRadar SIEM 安全漏洞

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...

PT-2024-24109 · Hewlett Packard +1 · Aos-8 Instant/Aos-10 Ap +4

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities results i...

CVE-2024-35204: Least Privilege Violation

Veritas System Recovery before 23.3Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks...

CVE-2024-35204

Veritas System Recovery versions prior to 23.3_Hotfix are vulnerable to a privilege escalation flaw caused by incorrect permissions on the Veritas System Recovery folder. A local attacker can exploit this by creating a specially crafted file in an arbitrary location within the file system, includ...

CVE-2024-35204

Veritas System Recovery before 23.3Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks...

CVE-2024-4605 Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution

The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributor...

CVE-2024-4605

CVE-2024-4605 (Breakdance for WordPress) is a remote code execution vulnerability reported for all versions up to 1.7.1. The issue arises from Breakdance storing custom data in post metadata without an underscore prefix, enabling lower-privileged users (e.g., contributors) to edit data via the UI...