EnGenius多款产品 安全漏洞

EnGenius ENH1350EXT and others are an outdoor wireless access point from EnGenius. A security vulnerability exists in various EnGenius products, which stems from a command injection due to incorrect operation of the parameter wifischeduledayem5. The following products are affected: EnGenius...

PT-2024-17160 · Engenius · Engenius Ens500-Ac +2

Name of the Vulnerable Software and Affected Versions: EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT versions up to 20241118 Description: A critical issue affects an unknown function of the file /admin/network/wifi schedule. The manipulation of the argument wifi schedule day em 5 leads to command...

CVE-2024-48901

A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report...

UBUNTU-CVE-2024-48901

A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report...

CVE-2024-48901

CVE-2024-48901 describes an IDOR-style authorization issue in Moodle: users may access the schedule of a report without having edit permission. Connected docs indicate affected Moodle versions include pre-4.1.14, pre-4.2.11 (4.2.x), pre-4.3.8 (4.3.x), and pre-4.4.4 (4.4.x). Multiple sources (GHSA...

PT-2024-35380 · Unknown · Weshacks Github Repository

Name of the Vulnerable Software and Affected Versions: WesHacks GitHub repository versions prior to 17 November 2024 or commit 93dfb83 Description: The issue concerns the presence of links to Leostop, a site potentially hosting malicious injected JavaScript files, in the schedule.html page of the...

The vulnerability of the ice component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the ice component in the Linux operating system’s kernel is related to incorrect blocking in the iceschedulereset function. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2024-51157

07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery CSRF via the component http://erp.07fly.net:80/oa/OaSchedule/add.html...

07FLYCMS 安全漏洞

07FLYCMS is a free and open source content management system CMS from China Zero Takeoff 07FLY, which can be used independently to meet the needs of various types of enterprise website development and construction! A security vulnerability exists in 07FLYCMS version V1.3.9, which originates from...

Code-Projects E-Health Care System 注入漏洞

Code-Projects E-Health Care System is an e-health care system from Code-Projects open source. An injection vulnerability exists in Code-Projects E-Health Care System version 1.0, which originates in the file /Doctor/userappointment.php with parameters scheduleid/scheduledate/scheduleday/starttime...

CVE-2024-7876

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml...

The vulnerability of the netem_dequeue() function in the Linux kernel’s network scheduling subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the netemdequeue function in the net/sched/schnetem.c module of the Linux operating system’s network scheduling subsystem is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.3.8 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Ram in WordPress Plugin Timetable and Event Schedule versions = 2.3.8...

CVE-2020-36840

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxrouteurl function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers t...

CVE-2020-36840

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxrouteurl function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers t...

CVE-2020-36840 Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxrouteurl function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers t...

WordPress Timetable and Event Schedule Plugin <= 2.3.8 is vulnerable to Broken Access Control

Software Timetable and Event Schedule Type Plugin Vulnerable versions = 2.3.8 Fixed in 2.3.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2020-36840 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID d75a5069efd3 Credits Ram Required...

PT-2024-10850 · Motopress · The Timetable/Event Schedule By Motopress

Name of the Vulnerable Software and Affected Versions: The Timetable and Event Schedule by MotoPress plugin for WordPress versions up to, and including, 2.3.8 Description: The issue is related to a missing capability check on the wp ajax route url function called via a nopriv AJAX action. This...

WordPress Appointment Booking Calendar plugin <= - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...

WordPress Appointment Booking Calendar plugin <= 1.6.7.53 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jeewan Kumar Bhatta in WordPress Plugin Simply Schedule Appointments versions = 1.6.7.53...