406,158 results · Feed
-
Critical 9.1
Host Administrator Path Containment Bypass in Progress WS_FTP Server
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
-
Critical 9.1
Privilege Escalation via Missing Authorization in WS_FTP Manager
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exe…
-
Medium 4.3
Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying mul…
-
Medium 6.6
Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.
-
Medium 6.8
SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication facto…
-
Critical 10.0CVE-2026-84295 Public exploit
Improper Authentication in Progress WS_FTP Server
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
-
High 8.7
Resource exhaustion from RPC sessions kept for requests to unknown interface
P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are…
-
Low 2.3
Alarm data length not validated against received frame length
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length…
-
Medium 5.3
Out-of-bounds read of DCP block header in DCP Set and Identify request parsing
P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the block length of the following block is …
-
High 8.7
NULL pointer dereference on implicit read of user specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record index, if the application has registered a read callback. A remote unauthenticated atta…
-
High 8.7
Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the avail…
-
High 7.7
Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.
-
High 7.1
Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offset of the APDU status was computed as the frame length minus 4 using 16-bit arithmetic,…
-
High 7.1
Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper bound, so a truncated frame, or a frame consisting only of VLAN …
-
High 8.7
NULL pointer dereference on implicit read of AR specific record index
P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and the expected identification data of a slot or subslot). A re…
-
Critical 9.3
Out-of-bounds write when parsing AR Vendor Block requests
P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comp…
-
High 8.7
Infinite loop when reading PDPortDataCheck record of subslot 0
P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device stops responding. A re…
-
High 7.2
Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafte…
-
Critical 9.2
Logon bypass (trust of attacker-controlled completed-methods list)
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8…
-
Low 2.9
Endpoint credential minting (insecure default allow-list)
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from…
-
Medium 6.5
WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
-
High 7.5
WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
-
High 8.8
WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
-
High 8.8
WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.
-
High 8.8
WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
-
High 7.2
WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.
-
High 7.2
WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
-
High 7.2
WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
-
High 8.8
WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
-
High 8.8
WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.
-
High 7.2
WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
-
High 8.8
WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
-
High 7.2
WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
-
High 8.8
WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
-
High 8.8
WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions.
-
High 8.8
WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
-
High 7.2
WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
-
High 7.2
WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
-
High 7.1
WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
-
Critical 9.8
WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.