UBUNTU-CVE-2024-22116

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure...

PT-2024-38071 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.27 Description: The issue is related to Stored Cross-Site Scripting via the no more...

CVE-2024-22116: Improper Control of Generation of Code

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure...

PT-2024-29546 · Sap · Sap Permit To Work

Name of the Vulnerable Software and Affected Versions: SAP Permit to Work affected versions not specified Description: The issue allows an authenticated attacker to access information that would otherwise be restricted, causing low impact on the confidentiality of the application. There is no...

CVE-2024-7399: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority...

The vulnerability of the Jenkins Automation Remoting server library allows for the execution of arbitrary code.

The vulnerability of the Jenkins Automation Remoting server library is related to deficiencies in path name restrictions for restricted access catalogs. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading class and resource files from the controller via...

Zabbix 安全漏洞

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix versions 6.4.15 and 7.0.0rc2, which stems from the fact that an administrator with restricted...

CVE-2024-22116

CVE-2024-22116 affects Zabbix: an administrator with restricted permissions can abuse the Script Execution feature in the Monitoring Hosts section by exploiting the Ping script’s parameters, due to missing default escaping. This leads to arbitrary code execution and infrastructure compromise. Pub...

PT-2024-29354 · It Solutions · It Solutions Enjay Crm Os

Name of the Vulnerable Software and Affected Versions: IT Solutions Enjay CRM OS version 1.0 Description: The issue in the Hardware info module allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system. Recommendations: For IT Solutions...

Enjay IT Solutions Enjay CRM 安全漏洞

Enjay IT Solutions Enjay CRM is a customer relationship management software from Enjay IT Solutions, India. A security vulnerability exists in Enjay IT Solutions Enjay CRM version 1.0, which stems from a vulnerability that allows an attacker to escape a restricted endpoint environment and gain...

CVE-2024-41309: Improper Access Control

An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system...

CVE-2024-41309

An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system...

PT-2024-29353 · It Solutions · It Solutions Enjay Crm Os

Name of the Vulnerable Software and Affected Versions: IT Solutions Enjay CRM OS version 1.0 Description: The issue in the Ping feature allows attackers to escape the restricted terminal environment and gain root-level privileges on the underlying system. Recommendations: For IT Solutions Enjay C...

Enjay IT Solutions Enjay CRM 安全漏洞

Enjay IT Solutions Enjay CRM is a customer relationship management software from Enjay IT Solutions, India. A security vulnerability exists in Enjay IT Solutions Enjay CRM version 1.0, which stems from a vulnerability that allows an attacker to escape a restricted endpoint environment and gain...

The vulnerability of the Omnivise T3000 Application Server’s software-defined hardware environment for monitoring industrial processes in Siemens Omnivise T3000 systems arises from incorrect restrictions on path names in the restricted access catalog. This allows attackers to upload arbitrary files.

The vulnerability of the Omnivise T3000 Application Server, a software-and-hardware platform for managing and monitoring industrial processes from Siemens, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious act...

PT-2024-25620 · Unknown · School Management System +1

Name of the Vulnerable Software and Affected Versions: School Attendance Monitoring System and School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue allows an attacker to create a specially crafted URL and send it to a victim to obtain details of their session...

PT-2024-25623 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue affects the system, allowing an attacker to exploit it by sending a specially crafted query to the server. This can lead to the retrieval of all stored...

PT-2024-25625 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the view...

AMD SEV-SNP 安全漏洞

AMD SEV-SNP is a secure encrypted virtualization firmware from UltraMicroelectronics AMD. A single key is used to encrypt system memory. AMD SEV-SNP suffers from a security vulnerability that stems from an improper restriction on write operations causing a malicious hypervisor to overwrite the...

PT-2024-5385 · D Link · D-Link Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07 Description: A critical issue has been found in the function msp info htm of the file msp info.htm, related to inadequate data sanitization on the management level when processing the cmd parameter. This can lead ...