CVE-2024-51567

upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...

Security Advisory 0105

Security Advisory 0105 PDF Date: October 29, 2024 Revision | Date | Changes ---|---|--- 1.0 | October 29, 2024 | Initial release Description Multiple vulnerabilities exist for the Arista Edge Threat Management - Arista NG Firewall NGFW: 1 Description : A user with administrator privileges can...

CVE-2024-50453

CVE-2024-50453 is a Relative Path Traversal vulnerability in the WordPress plugin family The Pack Elementor addons. Affected versions are listed as from n/a through 2.0.9. The underlying issue enables PHP Local File Inclusion, which could allow an attacker to access restricted files on the server...

CVE-2024-50624

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is...

CVE-2024-50624

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is...

Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2024-2679)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-8827

Name of the Vulnerable Software and Affected Versions: Wget versions prior to 1.25.0 Description: The issue is related to insufficient validation of requests on the server side, allowing attackers to exploit Wget's shorthand URL handling. This can lead to Server-Side Request Forgery SSRF attacks,...

CVE-2015-2863

creationtimestamp| type| source ---|---|--- 2024-10-27 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-10-27 2024-11-09 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-09 2025-01-20 00:00:00+00:00| seen| The Shadowserver...

Fortinet Fortigate Lack of certificate verification when establishing secure connections to external end-points (FG-IR-21-239)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-239 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 throu...

CVE-2024-50624

CVE-2024-50624 affects KDE PIM’s KMail, specifically the Account Wizard, where configuration retrieval uses cleartext HTTP instead of HTTPS for autoconfig servers (e.g., http://autoconfig.example.com or http://example.com/.well-known/autoconfig). Connected advisories confirm this issue in KMail A...

PT-2024-34364

Name of the Vulnerable Software and Affected Versions: KDE Kmail versions prior to 6.2.0 Description: The issue allows man-in-the-middle attackers to trigger the use of an attacker-controlled mail server. This is because cleartext HTTP is used for retrieving configuration from URLs such as...

CVE-2024-50624

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is...

PT-2024-39718 · WordPress · The Formfacade

Name of the Vulnerable Software and Affected Versions: The FormFacade – WordPress plugin for Google Forms plugin for WordPress versions up to, and including, 1.3.6 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This...

PT-2024-39653 · WordPress · The Poll Maker – Versus Polls

Name of the Vulnerable Software and Affected Versions: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions up to, and including, 5.4.6 Description: The issue is related to generic SQL Injection via the order by parameter due to insufficient escaping on the...

Fortinet Fortigate Lack of certificate verification when establishing secure connections (FG-IR-18-292)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-18-292 advisory. - An improper certificate validation vulnerability CWE-295 in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-10377

CVE-2024-10377 affects ESAFENET CDG 5. The issue is in the function actionPassDecryptApplication1 of /com/esafenet/servlet/client/DecryptApplicationService.java. The attacker can manipulate the id parameter to trigger SQL injection, with remote exploitability reported. Publicly disclosed exploits...

CVE-2024-47023

CVE-2024-47023 is an elevation-of-privilege in the Pixel modem due to a logic error in the code. The vulnerability could allow remote escalation with no user interaction. Pixel bulletin entries show the issue as EoP in the Modem subcomponent and indicate that applying security patch level 2024-10...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...