CVE-2024-23669

An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI...

CVE-2024-23670

An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI...

WordPress Brave Popup Builder Plugin <= 0.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Brave Popup Builder Type Plugin Vulnerable versions = 0.6.9 Fixed in 7.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35655 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 529027c4f5e6 Credits savphill Required privilege...

Fortinet FortiWeb Format string vulnerability in the CLI (FG-IR-22-187)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-187 advisory. - A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions...

PT-2024-25761

Name of the Vulnerable Software and Affected Versions QDOCS Smart School version 7.0.0 Description The issue is related to Cross Site Scripting XSS, which results in arbitrary code execution in admin functions, specifically when adding or updating records. This could potentially allow an attacker...

LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: LeptonCMS 7.0.0 - Remote Code Execution RCE Authenticated Date: 2024-1-19 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://www.lepton-cms.com/ Version : 7.0.0 1 Login with admin cred https://127.0.0.1/LEPTON/backend/login/index.php 2 Go to Languages place...

CVE-2022-4966

CVE-2022-4966 affects sequentech admin-console up to version 6.1.7, impacting the Election Description Handler component. The issue enables cross-site scripting and can be exploited remotely. A fix is available in version 7.0.0-beta.1 (patch 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d); upgrading th...

CVE-2023-42791

A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests...

sf_event_mgt Security Vulnerability

sfeventmgt is a TYPO3 CMS event management and registration extension based on ExtBase and Fluid. A security vulnerability exists in version 7.0.0 of sfeventmgt, which stems from a security flaw during the update of the extension to TYPO3 12.4...

Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...

CVE-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...

CVE-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...

Lepton CMS 7.0.0 Remote Code Execution Vulnerability

Exploit Title: LeptonCMS Version : 7.0.0 Remote Code Execution Exploit Author: tmrswrr Category: Webapps Vendor Homepage: https://www.lepton-cms.com/ Version : 7.0.0 Tested on: https://www.softaculous.com/apps/cms/LEPTON 1 Login with admin cred https://127.0.0.1/LEPTON/backend/login/index.php 2 G...

Malicious code in ifl-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a78e3ac1b585e32b8d93d41fa60e308981f4af36c1b67dedfe093df78770d540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

CVE-2023-45585

An insertion of sensitive information into log file vulnerability CWE-532 in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, versi...

PT-2023-7272 · Fortinet · Forticlient

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClient versions 7.0.0 through 7.0.9 Fortinet FortiClient versions 7.2.0 through 7.2.1 Description: The issue is related to the use of hard-coded credentials in Fortinet FortiClient for Windows, allowing an attacker to bypass...

CVE-2023-42788

An improper neutralization of special elements used in an os command 'OS Command Injection' vulnerability CWE-78 in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local...

Fortinet FortiADC Operating System Command Injection Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet. A security vulnerability exists in Fortinet FortiADC that originates from an operating system command injection vulnerability in the management interface. Affected products and versions: FortiADC versions 7.1.0 through 7.1.1,...

Redis 安全漏洞

Redis Labs Redis is an open source, ANSI C, network-enabled, memory-based, persistent logging, key-value Key-Value storage database from Redis Labs, Inc. that provides APIs in multiple languages. A security vulnerability exists in Redis versions 7.0.0 through prior to 7.0.12, which stems from a...