Redaxo 安全漏洞

Redaxo is a content management system from Redaxo open source. A security vulnerability exists in Redaxo version v5.17.1. An attacker exploiting this vulnerability could read arbitrary files on the server running the application...

PT-2024-7096 · Adobe · Indesign Desktop

Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions 19.4, 18.5.3 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution. An attacker could exploit this by uploading a maliciou...

Agnaistic 安全漏洞

Agnaistic is a chatbot from Agnaistic Open Source. A security vulnerability exists in Agnaistic version 1.0.330 and earlier versions. An attacker could exploit the vulnerability to upload an image file anywhere on the server...

CVE-2024-44760

Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to access sensitive information regarding the server...

Multiple Safie products vulnerable to improper server certificate verification

Overview Multiple Safie products are vulnerable to improper server certificate verification CWE-295. The product can be operated via port 11029/TCP and Bluetooth, and its communications are AES encrypted. The product user can obtain the encryption key from the cloud server based on the...

Exploit for CVE-2018-2894

Weblogic CVE-2018-2894 CVE-2018-2894 0x01 前言 Oracle 7月更新中，修复了Weblogic Web Service Test Page中一处任意文件上传漏洞，Web Service Test Page 在“生产模式”下默认不开启，所以该漏洞有一定限制， 利用该漏洞，可以上传任意jsp文件，进而获取服务器权限。 0x02 漏洞环境 Ubuntu 16.04 https://github.com/vulhub/vulhub/blob/master/weblogic/CVE-2018-2894/ 执行如下命令，启动weblogic 12.2.1....

CVE-2024-22218

XML External Entity XXE vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution RCE, or...

CVE-2024-22218

An XML External Entity (XXE) vulnerability exists in Terminalfour versions 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4. This flaw allows authenticated users to submit malicious XML through unspecified features, potentially enabling them to access the underlying server, achieve remot...

CVE-2024-22219

An XML External Entity (XXE) vulnerability exists in Terminalfour (versions 8.0.0001 through 8.3.18) and XML JDBC (versions up to 1.0.4). The flaw allows authenticated users to submit malicious XML via unspecified features. This could enable an attacker to access the underlying server, perform Re...

CVE-2024-22218

XML External Entity XXE vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution RCE, or...

PT-2024-19283 · Terminalfour · Terminalfour

Name of the Vulnerable Software and Affected Versions: Terminalfour versions 8.0.0001 through 8.3.18 XML JDBC versions up to 1.0.4 Description: The issue allows authenticated users to submit malicious XML via unspecified features, which could lead to various actions such as accessing the underlyi...

PT-2024-7640 · Unknown · Location Intelligence

Name of the Vulnerable Software and Affected Versions: Location Intelligence versions prior to V4.4 Description: The issue is related to insufficiently strong data encryption. This could allow an unauthenticated attacker in an on-path position to read and modify any data passed over the connectio...

PT-2024-6010 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution by an attacker. An attacker cou...

CVE-2024-24621

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user...

CVE-2024-24621

CVE-2024-24621 affects Softaculous Webuzo, describing an authentication bypass through the password-reset flow. The connected documents consistently state that remote, anonymous attackers can exploit this vulnerability to gain full server access as root. The exploitation details are provided (rem...

CVE-2024-5080

The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the embed feature. An attacker can access unpublished or private resource data by inferring the slug or URL of the resource that can be embedded. Note: This is only exploitable if the resource allows embedding a...

CVE-2023-7062

The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possible for attackers with contributor access or higher to read the contents of arbitrary files on the server, which can contain sensitive...

GHSA-JFGP-674X-6Q4P Weblate vulnerable to improper sanitization of project backups

Impact Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. Patches This issue has been addressed in Weblate 5.6.2 via...

PT-2024-26883 · Cososys +1 · Cososys Unify +1

Name of the Vulnerable Software and Affected Versions: Netwrix CoSoSys Endpoint Protector versions 5.9.3 and earlier CoSoSys Unify versions 7.0.6 and earlier Description: The issue concerns a remote code execution vulnerability in the Endpoint Protector and Unify agent. This vulnerability arises...