PT-2024-39915 · WordPress · Elementinvader Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementInvader Addons for Elementor plugin for WordPress versions up to, and including, 1.2.9 Description: The issue allows authenticated attackers with contributor-level access and above to view private, draft, and password-protected posts,...

JVN#41397971: Multiple vulnerabilities in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software

AIPHONE IX SYSTEM is an IP Network Audio-Video Intercom and IXG SYSTEM is an IP-based Residential System. IX SYSTEM, IXG SYSTEM, and System Support Software contain multiple vulnerabilities listed below. OS command injection CWE-78 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0...

CVE-2024-7755 HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials

The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials...

CVE-2024-49396 Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100

The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information...

CVE-2024-49396

CVE-2024-49396 affects Elvaco M-Bus Metering Gateway CMe3100 (version 1.12.1). The flaw is insufficiently protected credentials, enabling an attacker to impersonate Elvaco and send false information. Public documentation from CISA/ICSA notes remote exploitation with low attack complexity and prov...

Kieback&Peter DDC4000 Series

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Kieback&Peter Equipment : DDC4000 Series Vulnerabilities : Path Traversal, Insufficiently Protected Credentials, Use of Weak Credentials 2. RISK EVALUATION Successful exploitation of these...

CVE-2024-7417

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the datafetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected...

The vulnerability of software platforms for developing and managing online stores like Magento Open Source and Adobe Commerce stems from lack of access control mechanisms. This allows attackers to bypass security measures and gain unauthorized access to protected information.

The vulnerability of software platforms for developing and managing Magento Open Source and Adobe Commerce online stores is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to bypass security measures and gain unauthorized access to protected informatio...

The vulnerability of the Core server component of Oracle WebLogic Server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Core server component of Oracle WebLogic Server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using network T3/IIOP protocols...

PT-2024-33506 · Elvaco · Elvaco

Name of the Vulnerable Software and Affected Versions: Elvaco affected versions not specified Description: The issue arises from insufficiently protected credentials, potentially allowing an attacker to impersonate Elvaco and send false information. Recommendations: At the moment, there is no...

The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in the possibility of an out-of-buffer operation, which allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of Adobe Lightroom’s graphic editor arises from the possibility of operations going beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Adobe Lightroom’s graphic editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

PT-2024-38333 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.3.986 Description: The issue allows authenticated attackers with subscriber-level access and above to extract data from password protected posts vi...

The vulnerability of the application programming interface of the Avanpost IDM system lies in the insufficient verification of access rights to objects within the application. This allows a perpetrator to gain access to protected information.

The vulnerability of the application programming interface of the Avanpost IDM system relates to insufficient verification of access rights to objects within the application. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information...

The vulnerability of the SAP Business Objects Business Intelligence Platform lies in its ability to download files of a dangerous type without limit, allowing attackers to compromise the integrity of the protected information.

The vulnerability of the SAP Business Objects Business Intelligence Platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the validateAMCWSConnection method in the Ivanti Avalanche mobile device management system allows a hacker to disclose protected information.

The vulnerability of the validateAMCWSConnection method in the Ivanti Avalanche mobile device management system is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

The vulnerability of the application programming interface of the Avanpost IDM system lies in the insufficient verification of access rights to objects within the application. This allows a perpetrator to gain access to protected information.

The vulnerability of the application programming interface of the Avanpost IDM system relates to insufficient verification of access rights to objects within the application. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected information...

The vulnerability of the Graphics component in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Graphics component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Faces Mojarra component in the Ivanti Avalanche mobile device management system allows a hacker to disclose protected information.

The vulnerability of the Faces Mojarra component in the Ivanti Avalanche mobile device management system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

The vulnerability of the Kerberos protocol for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Kerberos protocol for Windows operating systems lies in the absence of the necessary encryption step. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...