CVE-2024-48427

A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manageservice&id...

CVE-2024-38002

The CVE-2024-38002 issue affects Liferay Portal and Liferay DXP, where the workflow component does not properly enforce permission checks when updating a workflow definition via the headless API. This allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE...

CVE-2024-38002

The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote...

CVE-2024-40089

A Command Injection vulnerability in Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device...

Qnap QTS Out-of-bounds Read (CVE-2022-27598)

A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP QVR Pro appliances...

CVE-2024-9379

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements...

CVE-2024-9381

Ivanti Cloud Services Appliance (CSA) is affected by a path traversal vulnerability in versions prior to 5.0.2. The flaw allows an authenticated administrator to bypass restrictions, enabling potential impact on confidentiality, integrity, and availability as indicated by CVSS 3.1 metrics. Ivanti...

CVE-2024-33506

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain ADOM to access device summary of unauthorized ADOMs via crafted HTTP...

PT-2024-7353 · Ivanti · Ivanti Cloud Services Appliance

Name of the Vulnerable Software and Affected Versions: Ivanti Cloud Services Appliance versions prior to 5.0.2 Description: The issue is related to a SQL injection vulnerability in the admin web console of Ivanti Cloud Services Appliance. This vulnerability allows a remote authenticated attacker...

CVE-2024-25707

There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript code in the their own browser Self XSS. A...

Synology DiskStation Manager Improper Neutralization of Input During Web Page Generation (CVE-2018-13293)

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Incorrect Default Permissions (CVE-2018-13286)

Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to obtain sensitive information via the world readable configuration. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Improper Neutralization of Special Elements used in an OS Command (CVE-2022-22688)

Improper neutralization of special elements used in a command 'Command Injection' vulnerability in File service functionality in Synology DiskStation Manager DSM before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors. This plugin only works wi...

Synology DiskStation Manager Improper Neutralization of Special Elements used in an OS Command (CVE-2022-27616)

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in webapi component in Synology DiskStation Manager DSM before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors. This plugin only works with...

Synology DiskStation Manager OS Command Injection (CVE-2022-22684)

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in task management component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors. This plugin only work...

Synology DiskStation Manager Path Traversal (CVE-2022-27610)

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology DiskStation Manager DSM before 6.2.3-25423 allows remote authenticated users to delete arbitrary files via unspecified vectors. This plugin only works with Tenable.ot. Please...

Synology DiskStation Manager Path Traversal (CVE-2022-22679)

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in support service management in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote authenticated users to write arbitrary files via unspecified vectors. This plugin only works with...

Synology DiskStation Manager OS Command Injection (CVE-2021-29083)

Improper neutralization of special elements used in an OS command in SYNO.Core.Network.PPPoE in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote authenticated users to execute arbitrary code via realname parameter. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Path Traversal (CVE-2021-33182)

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in PDF Viewer component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to read limited files via unspecified vectors. This plugin only works with Tenable.ot. Please...

CVE-2024-28808

An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications...