CVE-2024-52476

Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through = 1.5.3...

PT-2024-40372 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: ezplatform-http-cache affected versions not specified Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...

CVE-2024-52476: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Stefan Bohacek Fediverse Embeds fediverse-embeds allows Upload a Web Shell to a Web Server.This issue affects Fediverse Embeds: from n/a through = 1.5.3...

CVE-2024-52490

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through = 2.5.1...

CVE-2024-52490

CVE-2024-52490 affects the WordPress Pathomation plugin (versions

CVE-2024-52490 WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through = 2.5.1...

CVE-2024-52490: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through = 2.5.1...

SpiderControl SCADA Web Server File Download Code Execution

The vulnerability of the SpiderControl SCADA Web Server is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2024-41081 · Spring · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework affected versions not specified Description: The issue is related to the org.springframework.web.multipart package of the Spring Web module in the Spring Framework, which is associated with incorrect restriction of the path...

Astra Linux – Vulnerability in Node.js

The team has identified a critical vulnerability in the http server of the most recent version of Node. Malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, allowing attackers to smuggle a second...

CLSA-2024-1732194710 httpd: Fix of 2 CVEs

CVE-2023-38709: faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses - CVE-2024-24795: HTTP response splitting in multiple modules allows an attacker that can inject malicious response headers into backend applications to...

Exploit for CVE-2024-29671

NEXTU FLETA Wifi6 Router RCE Exploit POC This document...

PHP 8.1.x < 8.1.31 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.1.31. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.31 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CVE-2024-11492

A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

PT-2024-34545 · Vegam 4I · Vegam 4I

Name of the Vulnerable Software and Affected Versions: Vegam 4i versions 6.3.47.0 and earlier Description: A Local File Inclusion issue allows a remote attacker to obtain sensitive information through the print label function. The filePathList parameter is susceptible to this issue, enabling a...

CVE-2024-52401

CVE-2024-52401 affects Hacklog DownloadManager plugin (WordPress). A CSRF to Arbitrary File Upload vulnerability exists in versions 2.1.4 and earlier. The CVE entry notes a high-impact flaw (CVSS v3.1: 9.6, network vector, no privileges, user interaction required, changed scope, complete confiden...

CVE-2024-52401 WordPress Hacklog DownloadManager plugin <=2.1.4 - CSRF to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF vulnerability in HuangYe WuDeng Hacklog DownloadManager hacklog-downloadmanager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through = 2.1.4...

CVE-2024-52401 WordPress Hacklog DownloadManager plugin <=2.1.4 - CSRF to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF vulnerability in 荒野无灯 Hacklog DownloadManager allows Upload a Web Shell to a Web Server.This issue affects Hacklog DownloadManager: from n/a through 2.1.4...

CVE-2024-52402: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in gunghoinc Exclusive Content Password Protect exclusive-content-password-protect allows Upload a Web Shell to a Web Server.This issue affects Exclusive Content Password Protect: from n/a through = 1.1.0...

CVE-2024-47820

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this...