The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized a...
AFFECTED_PRODUCTS:
Stitionai Devika
Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
AFFECTED_PRODUCTS:
Kube-Logging Logging Operator
AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with ro...
AFFECTED_PRODUCTS:
Adtran Sdg Smartos
A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a vict...
AFFECTED_PRODUCTS:
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator
... (+1)
A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/admin/core/update_sub_category. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remo...
AFFECTED_PRODUCTS:
Munyweki Insurance Management System
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary sc...
AFFECTED_PRODUCTS:
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator
... (+1)
AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address. All of the devices internet interfaces share a similar MAC address that only varies in their final o...
AFFECTED_PRODUCTS:
Adtran Sdg Smartos
Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.
AFFECTED_PRODUCTS:
Adtran Sdg Smartos,
Adtran 834 5 Firmware
Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject arbitrary JavaScript, as demonstrated by /mainPassword.html, /processIdentity.html, /public.html, /dhcp.html, /private.html, /hostname.html, /connectivity.html, /...
AFFECTED_PRODUCTS:
Adtran Netvanta 3120 Firmware
A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underl...
AFFECTED_PRODUCTS:
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator,
Arubanetworks Edgeconnect Sd Wan Orchestrator
... (+1)
A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization....
AFFECTED_PRODUCTS:
Shuttur Ecommerce Laravel Bootstrap
In ProgressĀ® TelerikĀ® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
AFFECTED_PRODUCTS:
Progress Telerik Report Server
In ProgressĀ® TelerikĀ® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.
AFFECTED_PRODUCTS:
Progress Telerik Reporting
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (A...
AFFECTED_PRODUCTS:
Acronis Cyber Infrastructure,
Acronis Cyber Infrastructure,
Acronis Cyber Infrastructure
... (+2)
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored DOM-based Cross-Site Scripting via the plugin's Magazine Grid/Slider widget in all versions up to, and including, 1.3.980 due to insufficient input sanitization and output escaping on user supplied attributes. This...
AFFECTED_PRODUCTS:
Royal-Elementor-Addons Royal Elementor Addons
The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the Gallery title field in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a...
AFFECTED_PRODUCTS:
Robogallery Robo Gallery
A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/config_time_sync.php of the component HTTP POST Request Handler. The manipulation of the argument ntp_server leads to os command injecti...
The AMP for WP ā Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-...
AFFECTED_PRODUCTS:
Ampforwp Accelerated Mobile Pages
A vulnerability was found in Spina CMS up to 2.18.0. It has been classified as problematic. Affected is an unknown function of the file /admin/pages/. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and...
AFFECTED_PRODUCTS:
Denkgroot Spina
The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute within the plugin's bookingform shortcode in all versions up to, and including, 10.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...
AFFECTED_PRODUCTS:
Wpbookingcalendar Booking Calendar
libcurl's URL API function
[curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode
conversions, to and from IDN. Asking to convert a name that is exactly 256
bytes, libcurl ends up reading outside of a stack based buffer when built to
use the *macidn* IDN backend. The conversio...
AFFECTED_PRODUCTS:
Haxx Libcurl
libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abo...
AFFECTED_PRODUCTS:
Haxx Libcurl
An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose information about devices part of the same fabric (footprinting), even though the protocol is designed to prevent access to such information.
An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Matter protocol versions before Matter 1.1 allows an attacker to replay manipulated CASE Sigma1 messages to make the device unresponsive untilĀ t...
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot.
This issue affects Apache Pinot: from 0.1 before 1.0.0.
Users are recommended to upgrade to version 1.0.0Ā and configure RBAC, which fixes the issue.
Details:Ā
When using a request to path ā/appconfigsā to t...
AFFECTED_PRODUCTS:
Apache Pinot
XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file.
Users are recommended to upgrade to version 1.21.2, which fixes this issue.
AFFECTED_PRODUCTS:
Apache Drill
Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds read vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability to read contents of stack memory and use this information for further exploits.
The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
AFFECTED_PRODUCTS:
Plugins360 All In One Video Gallery
The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.1. This is due the plugin utilizing cocur and not preventing direct access to the generate-default.php file. This makes it possible for...
AFFECTED_PRODUCTS:
Wpchill Optimize Images Alt Text \(alt Tag\) \& Names For Seo Using Ai
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retr...
AFFECTED_PRODUCTS:
Wp-Meteor Wp Meteor
Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. A local authenticated malicious user with high privileges could potentially exploit this vulnerability leading to exposure of some UEFI code, leading to arbitrary code execution or escalation of privilege.
AFFECTED_PRODUCTS:
Dell Edge Gateway 3200 Firmware
The Funnel Builder for WordPress by FunnelKit ā Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and inclu...
AFFECTED_PRODUCTS:
Funnelkit Funnel Builder
The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
AFFECTED_PRODUCTS:
Technowich Wp Ulike
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file'...
AFFECTED_PRODUCTS:
Openstack Nova,
Openstack Nova,
Openstack Nova
The WP EasyPay ā Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect squa...
AFFECTED_PRODUCTS:
Wpeasypay Wp Easypay
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript v...
AFFECTED_PRODUCTS:
Litespeedtech Litespeed Cache
The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient verification on the user being supplied during a QR code login through the plugin. This makes it possible for unauthenticated attackers to l...
The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the āwpw_auto_poster_quick_delete_multipleā function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to dele...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the āwpw_auto_poster_update_tweet_templateā function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the āmapTypesā parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the āwp_nameā parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it p...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and p...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post m...
AFFECTED_PRODUCTS:
Wpwebinfotech Social Auto Poster
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page. Sel...
AFFECTED_PRODUCTS:
Sentry Sentry
An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a network.
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.
Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. This issue occurs when the plugin prompts the user to save these credentials within Okta Personal. A fix was implemented to properly escape these fields, addressing the vulnerabilit...
The cBioPortal for Cancer Genomics provides visualization, analysis, and download of large-scale cancer genomics data sets. When running a publicly exposed proxy endpoint without authentication, cBioPortal could allow someone to perform a Server Side Request Forgery (SSRF) attack. Logged in users co...
Ampache, a web based audio/video streaming application and file manager, has a stored cross-site scripting (XSS) vulnerability in versions prior to 6.6.0. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions c...
AFFECTED_PRODUCTS:
Ampache Ampache