PT-2024-11638 · WordPress · Wp Cerber Security

Name of the Vulnerable Software and Affected Versions: WP Cerber Security plugin for WordPress versions up to, and including 9.4 Description: The WP Cerber Security plugin for WordPress is vulnerable to IP Protection bypass due to the plugin improperly checking for a visitor's IP address. This...

Security Bulletin: IBM MQ is vulnerable to a privilege escalation attack (CVE-2024-31912)

Summary IBM MQ has addressed a privilege escalation vulnerability. Vulnerability Details CVEID:CVE-2024-31912 DESCRIPTION: IBM MQ could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. CVSS Base score: 7.5 CVSS Temporal...

CVE-2024-21685

CVE-2024-21685 affects Atlassian Jira Core Data Center. Introduced in versions 9.4.0, 9.12.0, and 9.15.0, it is a high-severity information disclosure (CVSS v3.1 base 6.5/7.4 depending on vector). An unauthenticated attacker can view sensitive data with user interaction required. Remediation from...

CVE-2024-2624 Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...

CVE-2024-2624

The connected Red Hat, NVD, OSV, and CVE records confirm a path traversal and arbitrary file upload vulnerability in parisneo/lollms-webui, affecting versions prior to 9.4 and exploitable via the /switch_personal_path endpoint in lollms_user.py. Root cause: insufficient sanitization of the path p...

PT-2024-23948 · Unknown · Easy Social Share Buttons

Name of the Vulnerable Software and Affected Versions: Easy Social Share Buttons versions n/a through 9.4 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This means that an...

WordPress plugin Easy Social Share Buttons 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

Mattermost fails to limit the number of active sessions

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table...

WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Easy Social Share Buttons versions = 9.4...

CVE-2024-28949 DoS via a large number of User Preferences

Mattermost Server versions 9.5.x before 9.5.2, 9.4.x before 9.4.4, 9.3.x before 9.3.3, 8.1.x before 8.1.11 don't limit the number of user preferences which allows an attacker to send a large number of user preferences potentially causing denial of service...

PT-2024-23244 · Appscreo · Easy Social Share Buttons

Name of the Vulnerable Software and Affected Versions: Appscreo Easy Social Share Buttons versions n/a through 9.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

Mobatek MobaXterm = 9.4 (CVE-2017-6805)

The version of Mobatek MobaXterm installed on the remote host is 9.4. It is, therefore, affected by a vulnerability as referenced in the CVE-2017-6805 advisory. - Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read arbitrary files...

Race condition

A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while another user deletes posts...

XWiki 9.4-rc-1 < 14.10.8, 15.0-rc-1 < 15.3 Information Disclosure Vulnerability (GHSA-gh64-qxh5-4m33)

Xwiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

Improper access control

Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2023-26411 · Intel · Intel Smart Campus

Name of the Vulnerable Software and Affected Versions: Intel Smart Campus android application versions prior to 9.4 Description: The issue is related to improper access control, which may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations:...

PT-2023-13458 · Gfi · Kerio Connect

Name of the Vulnerable Software and Affected Versions: Kerio Connect administration versions 9.4 through 9.4.1 Description: A security issue affects the administration component of Kerio Connect. The estimated number of potentially affected devices worldwide is not specified. There are reports of...

CVE-2023-39578

A stored cross-site scripting XSS vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field...

CVE-2023-35158 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

Hitachi Vantara Pentaho Business Analytics Server 安全漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server version 8.3.x, version 9.4.x up to and including version 9.4.0.1, and...