PT-2024-28414 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.6.3 Description: The issue arises from the plugin not properly checking all variations of an administrator's email, allowing unauthenticated attackers to...

PT-2024-24241 · Italtel · Italtel Embrace

Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: An issue was discovered where the server does not properly handle application errors, leading to a disclosure of information about the server. An unauthenticated user can craft specific requests to...

ROS-20240521-08

A vulnerability in the API interface of the Grafana web-based data representation tool is related to insecure privilege management. privilege management. Exploitation of the vulnerability could allow an attacker acting remotely, gain unauthorized access to restricted functions A vulnerability in...

The vulnerability of the distributed Git version control system arises from an incorrect limitation on the path name for the restricted access directory, allowing a violator to execute arbitrary code.

The vulnerability of the distributed Git version control system is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

PT-2024-25731

Name of the Vulnerable Software and Affected Versions smanga version 3.2.7 Description The issue is related to a path traversal vulnerability. It occurs because the file parameter at the "PHP/get file flow.php" interface is not properly filtered, allowing for arbitrary file reading. Recommendatio...

CVE-2023-51401

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Relative Path Traversal.This issue affects Ultimate Addons for Beaver Builder: from n/a through 1.35.13...

CVE-2023-46197

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: from n/a through 1.10.19...

CVE-2023-37888

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in By Averta Shortcodes and extra features for Phlox theme allows PHP Local File Inclusion.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.14.0...

CVE-2023-32297

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LWS LWS Affiliation allows PHP Local File Inclusion.This issue affects LWS Affiliation: from n/a through 2.2.6...

CVE-2023-24379

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/a through 3.1.9.9...

CVE-2023-23888

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Rank Math Rank Math SEO allows Path Traversal.This issue affects Rank Math SEO: from n/a through 1.0.107.2...

CVE-2022-45368

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Lenderd 1003 Mortgage Application allows Relative Path Traversal.This issue affects 1003 Mortgage Application: from n/a through 1.75...

CVE-2023-26526 WordPress Bookly plugin <= 21.7.1 - Authenticated Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Nota-Info Bookly allows Path Traversal, Manipulating Web Input to File System Calls.This issue affects Bookly: from n/a through 21.7.1...

The vulnerability of the FortiSandbox threat detection and mitigation system lies in its improper restriction on the path name to the restricted access catalog, allowing attackers to read arbitrary files.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to read arbitrary files using specially created HTTP requests...

GitLab 9.4 < 13.7.8 / 13.8 < 13.8.5 / 13.9 < 13.9.2 (CVE-2021-22186)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners CVE-2021-22186 Note that Nessus has not...

GitLab 12.2 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13275)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 CVE-2020-13275 Note that Nessus has not tested for this issue but...

The vulnerability of the FortiSandbox threat detection and mitigation system arises from an improper restriction on the path name to the restricted access catalog, allowing a perpetrator to execute arbitrary code.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

The vulnerability of the Apache OFBiz resource planning software lies in the incorrect restriction of the path name to the restricted directory. This allows a perpetrator to execute arbitrary code.

The vulnerability of Apache OFBiz’s resource planning software lies in incorrect restrictions on the path to the restricted-access directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing a specially crafted URL address...

PT-2024-32543 · WordPress · Shiftcontroller Employee Shift Scheduling

Name of the Vulnerable Software and Affected Versions: ShiftController Employee Shift Scheduling plugin versions up to, and including, 4.9.57 Description: The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the hc3...

amphp/artax Cookie leakage to wrong origins and non-restricted cookie acceptance

In artax version before 1.0.6 and 2 before 2.0.6, cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax fixed this issue by following newer browser implementations now. Cookies can only be set on domains higher or equal to the...