VulnCheck KEV: CVE-2015-8351

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

LlamaHub Security Breach

LlamaHub is an open source repository full of data loaders from the LlamaHub community. A security vulnerability exists in LlamaHub versions prior to 0.0.67. An attacker can execute arbitrary code by exploiting the vulnerability...

Artemis Java Test Sandbox Security Vulnerability

Artemis Java Test Sandbox is a JUnit 5 extension for the Applied Software Engineering TUM program at the Technical University of Munich, Germany. A security vulnerability exists in Artemis Java Test Sandbox versions prior to 1.11.2. An attacker can exploit this vulnerability to execute arbitrary...

PT-2024-14834

Name of the Vulnerable Software and Affected Versions Mergen Software Quality Management System versions prior to v1.2 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attack...

PT-2024-2046 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7.0-rc4-loong-devel-gb62ab1a397cf Description: The vulnerability is related to out-of-bounds memory access in the LoongArch BPF Berkeley Packet Filter component of the Linux kernel. The test tag test triggers ...

X.org Server Security Vulnerability

X.org Server is an open source free software from the X.org Foundation. A security vulnerability exists in versions of X.org Server prior to 21.1.11 that stems from incorrectly handling memory and could be exploited by an attacker to cause a denial of service, obtain sensitive information, or...

CVE-2023-49106

Missing Password Field Masking vulnerability in Hitachi Device Manager on Windows, Linux Device Manager Agent component.This issue affects Hitachi Device Manager: before 8.8.5-04...

Hitachi Device Manager Security Vulnerability

Hitachi Device Manager is a device management software from Hitachi, Japan. It is a solution for centralized management and monitoring of storage devices, designed to help users simplify storage resource management, optimize storage performance, and improve the reliability and availability of...

WordPress plugin Demo Import security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin WPGraphQL WooCommerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability in the...

PT-2024-11597 · WordPress · Contact Form Entries

Name of the Vulnerable Software and Affected Versions: Contact Form Entries WordPress plugin versions prior to 1.3.0 Description: The issue concerns the Contact Form Entries WordPress plugin, which does not validate data when outputting it in a CSV file. This lack of validation could lead to CSV...

CVE-2023-6843 easy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings Update

The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 does not properly secure some of its AJAX actions, allowing any logged-in users to modify its settings...

CVE-2024-23173

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php...

MediaWiki Security Breach

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki versions prior to 1.40.2, which stems from a cross-site...

DeShang DSKMS Access Control Error Vulnerability

DeShang DSKMS is a professional content payment system from DeShang, China. An Access Control Error vulnerability exists in DeShang DSKMS prior to version 3.1.2, which stems from the file public/install.php that results in incorrect access control...

DeShang DSShop Access Control Error Vulnerability

DeShang DSShop is a single-store mobile mall online store system from DeShang, China. The access control error vulnerability exists in DeShang DSShop prior to version 3.1.0. The vulnerability stems from the file public/install.php of the component HTTP GET Request Handler, which results in...

PT-2024-13551 · Atos · Atos Unify Openscape Voice

Name of the Vulnerable Software and Affected Versions: Atos Unify OpenScape Voice versions prior to V10R3.26.1 Description: A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice allows a remote attacker to view the contents of arbitrary files in the local...

Adobe Substance 3D Stager 缓冲区错误漏洞

Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. An out-of-bounds read vulnerability exists in Adobe Substance 3D Stager 2.1.3 and earlier versions, which can be exploited by attackers to obtain sensitive information...

AZL-39292 CVE-2022-36764 affecting package edk2 for versions less than 20230301gitf80f052277c8-40

EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability...

CVE-2023-50974

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...