CVE-2024-0259 Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to ga...

CVE-2024-0259 Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to ga...

CVE-2024-0259

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is vulnerable to privilege escalation. A low-privileged user can overwrite the service executable; upon service restart, the replaced binary runs with SYSTEM privileges. Affected: Windows agents before 3.04. Mitigation: up...

CVE-2024-0259: Incorrect Default Permissions

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to ga...

Fortra Robot Schedule Enterprise Agent for Windows 安全漏洞

Fortra Robot Schedule Enterprise Agent is a component of Fortra's enterprise task scheduling software. A security vulnerability exists in Fortra Robot Schedule Enterprise Agent for Windows prior to version 3.04, which originates from allowing a low-privileged user to overwrite the service...

CVE-2024-22311

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in N Squared Simply Schedule Appointments allows Reflected XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.6.20...

CVE-2024-22311 WordPress Simply Schedule Appointments plugin <= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in N Squared Simply Schedule Appointments allows Reflected XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.6.20...

CVE-2024-22311

Technical details about CVE-2024-22311 are not publicly provided in the supplied documents. The initial entry notes an XSS issue in Simply Schedule Appointments but no affected versions, impact specifics, exploit info, or fixes are disclosed here. Monitor for updates.

CVE-2024-22311: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in N Squared Simply Schedule Appointments allows Reflected XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.6.20...

PT-2024-19334 · Nsquared · N Squared Simply Schedule Appointments

Name of the Vulnerable Software and Affected Versions: N Squared Simply Schedule Appointments versions 1.6.6.20 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

WordPress Simply Schedule Appointments Plugin <= 1.6.6.20 is vulnerable to Cross Site Scripting (XSS)

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.6.20 Fixed in 1.6.6.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22311 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fb6daf2f8c79 Credits Rafie Muhamma...

WordPress Simply Schedule Appointments Plugin <= 1.6.7.7 is vulnerable to SQL Injection

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.7.7 Fixed in 1.6.7.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2342 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 36408cb83a66 Credits Krzysztof Zając Required privileg...

WordPress Simply Schedule Appointments Plugin <= 1.6.7.7 is vulnerable to SQL Injection

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.7.7 Fixed in 1.6.7.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2341 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 6389ada68f55 Credits Krzysztof Zając Required...

PT-2024-2443 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 Description: A critical issue has been found in the setSchedWifi function of the /goform/openSchedWifi file, which can lead to a stack-based buffer overflow when the schedStartTime argument is manipulated. This...

CVE-2023-52609 binder: fix race between mmput() and do_exit()

In the Linux kernel, the following vulnerability has been resolved: binder: fix race between mmput and doexit Task A calls binderupdatepagerange to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmgetnotzero first. This can race with Task ...

PT-2024-2493 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue has been found that affects the setSchedWifi function of the /goform/openSchedWifi file, leading to a stack-based buffer overflow due to the manipulation of the schedEndTime argument...

SUSE CVE-2023-52498

In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because asyncscheduledev executes its argument function synchronously if it...

PT-2024-3364

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a use-after-free vulnerability in the direct writes functionality of the Network File System NFS in the Linux kernel. This occurs when the nfs direct request is...

BIT-GITLAB-2023-4317 Incorrect Authorization in GitLab

An issue has been discovered in GitLab affecting all versions starting from 9.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a user with the Developer role to update a pipeline schedule from an unprotected branch ...

CVE-2024-1760

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssafactoryreset function. This makes it...