Archive
13 August 2024
Vulnerabilities first published on this day (UTC), newest first.
226 results · Feed
-
High 7.3
Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious t…
-
High 7.5
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB …
-
Low 3.9
Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to …
-
Medium 5.2
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged…
-
Low 3.9
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS…
-
Medium 5.7
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an …
-
High 7.2
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with acce…
-
High 8.5
Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report
In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.
-
High 8.5
Path Traversal in Ocean Data Systems Dream Report
In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL).
-
High 8.7
Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server
If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack.
-
Medium 5.9
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS vers…
-
Low 3.5
An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, …
-
Medium 5.5
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and …
-
Medium 6.4
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 thr…
-
Medium 4.7
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through …
-
Critical 9.5
Use of default credentials at Traccar fleet management solution
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by t…
-
Medium 5.3
Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and…
-
High 8.6
Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
-
High 7.1
Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSS
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.
-
Medium 6.1
Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
-
High 7.1
Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
-
Medium 5.9
Phoenix Contact: Start sequence allows attack during the boot process
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
-
Medium 6.5
WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.
-
Critical 10.0
WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.
-
Critical 9.8
WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10.
-
Critical 9.8
WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2.
-
High 7.5
WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.…
-
Medium 6.5
WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
-
Critical 9.1
Kibana arbitrary code execution via prototype pollution
A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary c…
-
High 7.5
IBM OpenBMC authentication bypass
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 2…
-
Medium 4.8
IBM Common Licensing cross-site scripting
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…
-
High 7.5
IBM Common Licensing information disclosure
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895.
-
High 7.5
WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through 2.2.28.
-
High 7.5
WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability
Incorrect Authorization vulnerability in WPWeb Docket (WooCommerce Collections / Wishlist / Watchlist) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Docket (WooCommerce Collections / Wishlist / Watchlist): from n/a before …
-
Medium 6.5
WordPress BetterDocs plugin <= 3.5.8 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
-
Medium 6.5
WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.This issue affects WooCommerce Product Table Lite: from n/a through 3.5.1.
-
Critical 9.1
WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerability
Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
-
High 8.6
WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
-
Medium 6.5
WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LearnPress: from n/a through 4.2.6.8.2.
-
High 7.5
WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.8.