TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3, which stems from the fact that if a mount points to a page that is accessible only to its users/groups, or if the mount is not configured but the...

CVE-2023-52952: Improper Protection of Alternate Path

A vulnerability has been identified in HiMed Cockpit 12 pro J31032-K2017-H259 All versions = V11.5.1 = V11.5.1 = V11.5.1 = V11.5.1 V11.6.2. The Kiosk Mode of the affected devices contains a restricted desktop environment escape vulnerability. This could allow an unauthenticated local attacker to...

PT-2024-14789 · Unknown · Himed Cockpit 18 Pro +2

Name of the Vulnerable Software and Affected Versions: HiMed Cockpit 12 pro versions 11.5.1 through 11.6.2 HiMed Cockpit 14 pro+ versions 11.5.1 through 11.6.2 HiMed Cockpit 18 pro versions 11.5.1 through 11.6.2 HiMed Cockpit 18 pro+ versions 11.5.1 through 11.6.2 Description: A restricted deskto...

Siemens HiMed Cockpit

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2024-32542 · Elementor · Elementsready Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementsReady Addons for Elementor versions n/a through 6.4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

CVE-2024-47323 WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin allows PHP Local File Inclusion.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through 3.6.7...

CVE-2024-44012

CVE-2024-44012 is a Local File Inclusion (path traversal) vulnerability in the WP Newsletter Subscription plugin for WordPress, affecting versions n/a through 1.1. The issue stems from improper restriction of pathnames, enabling PHP Local File Inclusion. Public sources in connected docs confirm t...

CVE-2024-47841 Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9...

WordPress plugin Vmax Project Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-39455 · Unknown · James Low Css Js Files

Name of the Vulnerable Software and Affected Versions: James Low CSS JS Files versions n/a through 1.5.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability allows for Path Traversal,...

CVE-2024-47841: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9...

WordPress plugin Hash Form 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

The vulnerability of the Ivanti Cloud Services Appliance’s network interface, related to incorrect path name restrictions for the restricted access catalog, allows a hacker to execute arbitrary code.

The vulnerability of the Ivanti Cloud Services Appliance relates to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2024-20492

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level...

CVE-2024-20492 Cisco Expressway Series Privilege Escalation Vulnerability

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level...

The vulnerability of the Rockwell Automation Pavilion8 platform’s simulation, control, and optimization functions arises from an improper limitation on the path name to the restricted access catalog. This allows a malicious actor to execute arbitrary code.

The vulnerability of the Rockwell Automation Pavilion8 platform for simulation, control, and optimization is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

WordPress plugin Checkout Mestres WP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-8632 · Cisco · Cisco Expressway Series

Name of the Vulnerable Software and Affected Versions: Cisco Expressway Series affected versions not specified Description: A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying...

CVE-2024-20492: Improper Neutralization of Special Elements used in a Command

A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level...

CVE-2024-45408

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...