Archive
14 October 2024
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
High 7.2
Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the resource parameter in all versions up to, and including, 5.2.6 due to insufficient input sanitization and output escaping when logging visitor requests. This make…
-
High 7.5
CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send…
-
High 8.8
Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows
In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.
-
High 7.1
Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app
In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could r…
-
High 8.0
Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32…
-
High 8.8
Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to…
-
High 7.7
RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script
VULNERABILITY DETAILS Rockwell Automation used the latest versions of the CVSS scoring system to assess the following vulnerabilities. The following vulnerabilities were reported to us by Sharon Brizinov of Claroty Research - Team82. A feature in the affected…
-
High 7.2
OS Command Injection in Restricted Command
The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.
-
High 7.8
GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices
Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.
-
High 7.5
TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
-
High 8.4
Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in…
-
High 8.4
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
-
High 8.4
Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
-
High 7.5
An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive i…
-
High 7.3
Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
-
High 7.3
Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.
-
High 7.5
An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update…
-
High 7.5
An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via t…
-
High 8.8
Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a …
-
High 7.5
An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attac…
-
High 7.5
An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive informat…
-
High 7.5
An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive informatio…
-
High 7.3
Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
-
High 7.5
An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive infor…
-
High 7.3
Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.
-
High 7.5
An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update …
-
High 7.3CVE-2024-48259 Scanner template
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
-
High 7.3
Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.