CVE-2024-50527: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through = 5.2.3...

CVE-2024-50530: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer stars-smtp-mailer allows Upload a Web Shell to a Web Server.This issue affects Stars SMTP Mailer: from n/a through = 2.2.1...

CVE-2024-50523: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50526: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through = 1.0.2...

CVE-2024-50525: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through = 2.0.4...

cgi.force_redirect configuration is bypassable due to the environment variable collision

...

REST-APIs unintentionally enabled in Century Systems FutureNet NXR series routers

Overview FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial factory default configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server GUI or Web...

SmartAgent 1.1.0 Server-Side Request Forgery

Exploit Title: SmartAgent v1.1.0 - Server-Side Request Forgery SSRF Date: 01-10-2024 Exploit Author: Alter Prime Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com Version: Build v1.1.0 Tested on: Kali Linux An unauthenticated user can trigger the web server to perform web reques...

VulnCheck KEV: CVE-2023-28769

The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17ABYO.1C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service DoS conditions on a vulnerable device...

Cisco Adaptive Security Appliance Code Execution

The vulnerability in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD VPN microprogramming device controllers is related to improper code generation. Exploitation of this vulnerability could allow an attacker to execute arbitrary code...

CVE-2024-49674

CVE-2024-49674 : WordPress EKC Tournament Manager plugin (versions ≤ 2.2.1) has a Cross-Site Request Forgery (CSRF) vulnerability that allows uploading a web shell to the web server. Exploitation would enable an attacker to place arbitrary files on the server via CSRF, potentially leading to unau...

CVE-2024-49674 WordPress EKC Tournament Manager plugin <= 2.2.1 - CSRF to Arbitrary File Upload vulnerability

Cross-Site Request Forgery CSRF vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through = 2.2.1...

PT-2024-9219 · Osmedeus +1 · Osmedeus +1

Name of the Vulnerable Software and Affected Versions: Osmedeus affected versions not specified Description: The issue is related to a Cross-site Scripting XSS vulnerability in the Osmedeus web server when viewing results from the workflow. This allows commands to be executed on the server. The...

CVE-2024-49674: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in lukashuser EKC Tournament Manager ekc-tournament-manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through = 2.2.1...

CVE-2024-50510

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through = 6.3...

CVE-2024-50511

Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through = 1.0.1...

CVE-2024-50510

CVE-2024-50510 affects the WordPress AR For Woocommerce plugin with affected versions n/a through 6.2. The issue is an unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to the web server. The CVSS vector indicates a critical, unauthenticated, network-ex...

CVE-2024-50511 WordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through = 1.0.1...

CVE-2024-50511

CVE-2024-50511 affects WordPress WP donimedia carousel plugin versions 1.0.1 and earlier. The vulnerability is an unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to the target server. This corresponds to an Arbitrary File Upload flaw in the plugin, wi...

CVE-2024-50510: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through = 6.3...