Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.
AFFECTED_PRODUCTS:
Mattermost Mattermost Server,
Mattermost Mattermost Server,
Mattermost Mattermost Server
A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument newtitle/newdescr leads to cross site scripting. The attack can be initiated remotely. The exp...
AFFECTED_PRODUCTS:
Code-Projects Simple Crud Functionality
A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed t...
AFFECTED_PRODUCTS:
Codezips Project Management System
Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.
AFFECTED_PRODUCTS:
Pega Infinity,
Pega Infinity,
Pega Infinity
... (+1)
A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/subcategory.php. The manipulation of the argument category leads to sql injection. The attack may be launched remot...
AFFECTED_PRODUCTS:
Phpgurukul Complaint Management System
A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The...
AFFECTED_PRODUCTS:
Phpgurukul Complaint Management System
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
AFFECTED_PRODUCTS:
Drupal Drupal
A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
AFFECTED_PRODUCTS:
Drupal Drupal,
Drupal Drupal
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.
AFFECTED_PRODUCTS:
Cyberpanel Cyberpanel
A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.
User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all l...
A vulnerability in the SonicWall SMA100 SSLVPN
firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication.
A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.
Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.
A vulnerability classified as critical has been found in PHPGurukul Complaint Management System 1.0. Affected is an unknown function of the file /admin/user-search.php. The manipulation of the argument search leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
AFFECTED_PRODUCTS:
Phpgurukul Complaint Management System
A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLib_X64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the...
Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful exploitation of this vulnerability could al...
This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious...
Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials.Â
Affected products:
ABB ASPECT - Enterprise v3.07.02;
NEXUS Series v3.07.02;
MATRIX Series v3.07.02
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.Â
Affected products:
ABB ASPECT - Enterprise v3.07.02;
NEXUS Series v3.07.02;
MATRIX Series v3.07.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Dangerous File Upload vulnerabilities allow upload of malicious scripts.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Service Control vulnerabilities allow access to service restart requests and vm configuration settings.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Information Disclosure vulnerabilities allow access to application configuration information.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Configuration Download vulnerabilities allow access to dependency configuration information.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Local File Inclusion vulnerabilities allow access to sensitive system information.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.Â
Affected products:
ABB ASPECT - Enterprise v3.08.01;
NEXUS Series v3.08.01;
MATRIX Series v3.08.01
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.Â
Affected products:
ABB ASPECT - Enterprise v3.07.02;
NEXUS Series v3.07.02;
MATRIX Series v3.07.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Denial of Service vulnerabilities where found providing a potiential for device service disruptions.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Denial of Service vulnerabilities where found providing a potiential for device service disruptions.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Unauthorized Access vulnerabilities allow Remote Code Execution.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Improper Input Validation vulnerability allows Remote Code Execution.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such...
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product.Â
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Series v3.08.02;
MATRIX Series v3.08.02
AFFECTED_PRODUCTS:
Abb Aspect Ent 2 Firmware,
Abb Aspect Ent 12 Firmware,
Abb Aspect Ent 256 Firmware
... (+16)
User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing.
Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability...
Inclusion of undocumented features or chicken bits issue exists in UD-LT1 firmware Ver.2.1.8 and earlier and UD-LT1/EX firmware Ver.2.1.8 and earlier. A remote attacker may disable the firewall function of the affected products. As a result, an arbitrary OS command may be executed and/or configurati...
UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands.
Incorrect permission assignment for critical resource issue exists in UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier. If an attacker with the guest account of the affected products accesses a specific file, the information containing credentials may be obtained.
The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Info Block link parameter in all versions up to, and including, 2.0.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level a...
AFFECTED_PRODUCTS:
Creativethemes Blocksy