PT-2024-20796 · Snow Snow · Snow Snow

Name of the Vulnerable Software and Affected Versions: snow snow version 2.0.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the dataScope parameter of the "system/role/list" interface. This enables the attacker to potentially access and manipulate...

CVE-2024-25168: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface...

DingFlow 安全漏洞

DingFlow is DingFlow open source is committed to helping small and medium-sized intelligent office system. DingFlow v.2.0.0 version of a security vulnerability , the vulnerability stems from the system/role/list interface of the dataScope parameter SQL injection vulnerability...

OneBlog Cross-Site Scripting Vulnerability

OneBlog is a Java blog. OneBlog suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data in the Role Management module, which can be exploited by an attacker to steal the victim's cookie-based authentication credentials...

CVE-2023-42954

A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests...

PT-2024-13067 · Clarisa · Filemaker Server

Name of the Vulnerable Software and Affected Versions: FileMaker Server versions prior to 20.3.1 Description: A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role...

CVE-2024-2469

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported...

CVE-2024-2469

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported...

CVE-2024-2443 Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub...

CVE-2024-2469 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported...

CVE-2024-2469 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance

An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.17, 3.9.12, 3.10.9, 3.11.7 and 3.12.1. This vulnerability was reported...

CVE-2024-29473

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the Role Management module...

CVE-2024-29473

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the Role Management module...

OneBlog 安全漏洞

OneBlog is a Java blog. OneBlog suffers from a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of user-supplied data in the Role Management module, which can be exploited by an attacker to steal the victim's cookie-based authentication credentials...

CVE-2024-29473

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting XSS vulnerability via the Role Management module...

CVE-2024-29473

OneBlog v2.3.4 contains a stored cross-site scripting (XSS) vulnerability in the Role Management module. The issue stems from insufficient input filtering/escaping of user-supplied data, enabling attacker-supplied scripts to be stored and executed in the victim’s browser. CVSS data indicates low ...

Popup Maker – Popup for opt-ins, lead gen, & more < 1.18.3 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin...

PT-2024-20491

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.8.0 through 3.12.0 Description An attacker with an Administrator role in GitHub Enterprise Server could gain SSH root access via remote code execution. This issue was reported via the GitHub Bug Bounty...

PT-2024-22919 · Oneblog · Oneblog

Name of the Vulnerable Software and Affected Versions: OneBlog version 2.3.4 Description: A stored cross-site scripting XSS issue was found in the Role Management module. This allows for malicious scripts to be stored and executed on the site. Recommendations: For OneBlog version 2.3.4, as a...

PT-2024-20393 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.13 GitHub Enterprise Server versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1 are not affected as they contain the fix, so the correct range is: GitHub Enterprise Server versions prior to 3.8.17,...