12021 matches found
ITFlow Cross Site Request Forgery
CVE: CVE-2024-25344 CWE: CWE-352 Vendor: ITFlow.org Affected product: ITFlow - Before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 Discoverer: stehled, WP-Pomoc.cz Attack-Type: Remote AV: Admin user has to open a page, provided by an attacker, which will then perform malicious request changing...
WonderCMS 4.3.2 Cross Site Scripting / Remote Code Execution
Author: prodigiousMind Exploit: Wondercms 4.3.2 XSS to RCE import sys import requests import os import bs4 if lensys.argv4: print"usage: python3 exploit.py loginURL IPAddress Port\nexample: python3 exploit.py http://localhost/wondercms/loginURL 192.168.29.165 5252" else: data = ''' var url =...
CVE-2024-20974
...
CVE-2024-20943
...
CVE-2024-20931
...
CVE-2024-20927
...
CVE-2024-20919
...
CVE-2024-20907
...
Login as User or Customer <= 3.8 - Admin Account Takeover
Description The plugin does not prevent users to log in as any other user on the site. 1. As an admin, log in as some user. Note the user ID. 2. Run the following curl command, filling in the ADMINID and the USERID: curl -v https://example.com/wp-admin/admin-ajax.php -H 'Cookie:...
CVE-2023-52395
Rejected reason: This is unused...
CVE-2023-43749
Rejected reason: This is unused...
CVE-2023-45738
Rejected reason: This is unused...
Open redirect
Rejected reason: This is unused...
CVE-2024-1216
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Intel Extreme Tuning Utility (XTU) February 2024 Security Update
Intel has informed HP of potential security vulnerabilities in some Intel® Extreme Tuning Utility XTU software, which might allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Intel has released updates to mitigate the potential...
GHSA-2JV5-9R88-3W3P vulnerabilities
Vulnerabilities for packages: reflex...
Why Are Compromised Identities the Nightmare to IR Speed and Efficiency?
Incident response IR is a race against time. You engage your internal or external team because there's enough evidence that something bad is happening, but you're still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability ...
Sql injection
Before Beetl v3.15.12, the rendering template has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading t...
