Archive
25 July 2024
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
High 8.8
Softaculous Webuzo Password Reset Command Injection
Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
-
High 8.8
Softaculous Webuzo FTP Management Command Injection
Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.
-
High 7.2
OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`
OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes i…
-
High 8.8
OpenObserve stored XSS vulnerability may lead to complete account takeover
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may…
-
High 8.4
Elevation of privilege in Absolute Secure Access clients and servers
There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid ad…
-
High 8.7
Authentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA7005
Positron Broadcast Signal Processor TRA7005 v1.20 is vulnerable to an authentication bypass exploit that could allow an attacker to have unauthorized access to protected areas of the application.
-
High 7.3
ForIP Tecnologia Administração PABX Authentication Form login sql injection
A vulnerability, which was classified as critical, has been found in ForIP Tecnologia Administração PABX 1.x. This issue affects some unknown processing of the file /login of the component Authentication Form. The manipulation of the argument usuario leads to…
-
High 8.4
Memory request logic vulnerability in the memory module. Impact: Successful exploitation of this vulnerability will aff…
-
High 8.8
LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contrib…
-
High 7.7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.
-
High 7.2CVE-2024-38288 Scanner template
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allo…
-
High 8.8
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the …
-
High 7.2CVE-2024-40318 Public exploit
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via upload…
-
High 7.3
A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer …
-
High 7.1
A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user c…
-
High 8.0
Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/W…