known_ransomware_campaign_use: Known

required_action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.

vulnerability_name: Palo Alto Networks PAN-OS Command Injection Vulnerability

author: Codex

content_markdown:
CVE-2024-3400 is an arbitrary-file-creation-to-command-injection vulnerability
in the GlobalProtect feature of specific PAN-OS releases. An unauthenticated
network attacker can reach the affected surface and execute code with root
privileges on the firewall. Palo Alto Networks rates the issue critical and
reports exploitation in the wild; CISA added it to the Known Exploited
Vulnerabilities catalog on 2024-04-12 with a remediation due date of
2024-04-19.

The vulnerable software version is only half of the exposure decision. The
firewall must also have a GlobalProtect gateway, a GlobalProtect portal, or
both configured. Device telemetry does not need to be enabled. Disabling
telemetry was early guidance that Palo Alto Networks later withdrew and is not
a mitigation.

## Evidence basis and limits

I reviewed the current Palo Alto Networks security advisory, the Unit 42
Operation MidnightEclipse threat brief, the CISA KEV entry, and the NVD record
while preparing this recipe, and rechecked the live advisory and NVD on
2026-08-21. Live GHAD `GHSA-v475-xhc9-wfxg` has **vulnerabilities empty**.
NVD enumerates exact affected hotfixes and last-affects **10.2.9 /
11.0.4 / 11.1.2 / 11.1.2-h1**. Vendor names **10.2.9-h1 / 11.0.4-h1 /
11.1.2-h3**. Those vendor hotfixes are **not** NVD first_patched
excludes. The published product-status table, courtesy hotfix lines,
Threat Prevention IDs, and withdrawal of telemetry-as-mitigation are
unchanged. I did not access a PAN-OS appliance, inspect a customer Tech
Support File (TSF), review proprietary PAN-OS source, execute a payload,
or perform live validation. Re-check the live vendor advisory and NVD
before approving a change because product and incident-response
guidance can be updated.

## When to use it

- A repository owns PAN-OS software/image pins, VM-Series deployment
  definitions, Panorama templates for managed firewalls, configuration exports,
  upgrade runbooks, vulnerability policy, or fleet inventory for PAN-OS 10.2,
  11.0, or 11.1.
- A scanner, CMDB record, ticket, or vendor alert identifies CVE-2024-3400 on a
  firewall with a GlobalProtect portal or gateway.
- A customer-managed VM-Series firewall may run an affected PAN-OS release.
  Managed Cloud NGFW is a different product and is not affected.
- A team needs a bounded repository change and operator handoff that separates
  upgrade, temporary prevention, and possible-compromise response.

Do not use this recipe to investigate a device by sending crafted requests or
to perform an unapproved production firewall upgrade. If attempted exploitation
or compromise is suspected, preserve evidence and route to human-led incident
response before rebooting or changing the appliance.

## Inputs

- A redacted inventory of every potentially affected firewall and HA peer:
  owner, environment, hardware or VM-Series form factor, customer-managed or
  managed-service status, deployed PAN-OS release, and authoritative evidence
  timestamp.
- GlobalProtect configuration evidence showing whether a gateway or portal is
  present. The vendor documents the web-interface locations as
  `Network > GlobalProtect > Gateways` and
  `Network > GlobalProtect > Portals`.
- Exposure evidence: public or private listener, ingress path, allowed source
  networks, DNS/load-balancer mapping, and which interface receives
  GlobalProtect traffic.
- Repository-controlled image references, marketplace identifiers, Terraform,
  configuration-as-code, Panorama templates, policy exports, upgrade runbooks,
  HA sequencing, maintenance window, health checks, and rollback plan.
- Threat Prevention evidence: Applications and Threats content version,
  availability of Threat IDs `95187`, `95189`, and `95191`, the vulnerability
  protection profile, and proof that the profile applies to the GlobalProtect
  interface.
- Security operations evidence supplied through an approved channel: relevant
  alerts, centralized logs, TSF collection status, Palo Alto Networks support
  case, incident commander, and credential-rotation owner. Do not commit TSFs,
  configurations containing secrets, or raw customer logs to the repository.
- The authorized boundary for appliance access. Unless the task explicitly
  grants live-change authority, the agent may change repository artifacts and
  prepare operator instructions only.

## Affected versions

Exposure requires **both** an affected release and a configured GlobalProtect
gateway or portal.

- **Vulnerable / NVD CPE:** exact last-affects **10.2.9 / 11.0.4 /
  11.1.2 / 11.1.2-h1**, plus earlier enumerated hotfixes on those
  trains. There is no GHAD first_patched and **no 10.2.9-h1 /
  11.0.4-h1 / 11.1.2-h3 exclude**.
- **Fixed / vendor prose:** Palo Alto Networks names these primary
  baselines: PAN-OS 10.2 `10.2.9-h1` and later, 11.0 `11.0.4-h1` and
  later, and 11.1 `11.1.2-h3` and later.
- **Do not invent:** flatten vendor fix labels **10.2.9-h1 / 11.0.4-h1 /
  11.1.2-h3** onto NVD exact **10.2.9 / 11.0.4 / 11.1.2-h1**, or
  invent a later hotfix.

The vendor also released courtesy hotfixes for commonly deployed older
maintenance lines. Within each line below, releases before the listed hotfix
are affected and the listed hotfix is the first fixed release:

| PAN-OS line | First fixed releases on older maintenance lines |
| --- | --- |
| 10.2 | `10.2.0-h3`, `10.2.1-h2`, `10.2.2-h5`, `10.2.3-h13`, `10.2.4-h16`, `10.2.5-h6`, `10.2.6-h3`, `10.2.7-h8`, `10.2.8-h3`, `10.2.9-h1` |
| 11.0 | `11.0.0-h3`, `11.0.1-h4`, `11.0.2-h4`, `11.0.3-h10`, `11.0.4-h1` |
| 11.1 | `11.1.0-h3`, `11.1.1-h1`, `11.1.2-h3` |

Select a currently supported, vendor-approved release compatible with the
device, plugins, HA pair, and operational policy rather than pinning to an old
minimum merely because it contains the CVE fix. Do not compare PAN-OS hotfix
suffixes as ordinary decimal versions.

The vendor lists PAN-OS 9.0, 9.1, 10.0, and 10.1 as unaffected by this CVE. It
also lists Cloud NGFW, Panorama appliances, and Prisma Access as unaffected.
That does not make a PAN-OS firewall managed *through* Panorama unaffected, and
it does not cover customer-managed VM-Series firewalls in AWS or Azure; those
firewalls are affected when the release and GlobalProtect configuration match.
Do not downgrade to an old unaffected PAN-OS branch as remediation.

## Indicator-of-exposure

Classify each target independently:

1. **Product:** It is a PAN-OS firewall or customer-managed VM-Series device,
   not managed Cloud NGFW, Panorama itself, or Prisma Access.
2. **Version:** It runs PAN-OS 10.2, 11.0, or 11.1 below the applicable fixed
   threshold.
3. **Configuration:** A GlobalProtect gateway or portal is configured. A portal
   alone is sufficient for the vendor's exposure condition.
4. **Reachability:** Untrusted traffic can reach that GlobalProtect surface.
   Reachability changes priority and containment, but a private listener does
   not change the vendor's affected-version classification.

Use repository search only to locate candidate ownership and configuration;
it does not prove the live appliance state:

```text
rg -n -i "globalprotect|global-protect|pan-os|panos|vm-series|panorama|95187|95189|95191|8836-8695" .
```

Confirm effective version and configuration from an approved read-only
inventory, signed export, or operator-provided screenshot. Do not infer the
deployed version from a desired-state file alone. Do not send an exploit,
path-manipulation cookie, command string, or vendor demonstration request to a
firewall to prove exposure.

A correctly applied Threat Prevention profile can contain initial exploitation,
but the device remains on vulnerable software until upgraded. Conversely,
device telemetry being disabled proves neither containment nor lack of
exposure.

## Remediation strategy

1. **Run the evidence-preservation gate before reboot.** Review approved alerts
   and operator-supplied evidence. If there is possible attempted exploitation,
   unexplained file activity, configuration access, unexpected processes, or
   interactive command execution, stop routine remediation. Palo Alto Networks
   says to collect a TSF for forensic analysis before rebooting into a fixed
   release because some prior-installation logs become inaccessible after the
   upgrade. Open a support and incident-response case.
2. **Upgrade to a fixed release.** Move every affected firewall and HA peer to
   a vendor-supported release at or beyond the correct fixed threshold. Update
   all repository-controlled image references, marketplace identifiers,
   configuration baselines, inventory policy, runbooks, and generated artifacts
   together. Keep upgrade order, failover, health checks, maintenance impact,
   and rollback under human review.
3. **Apply vendor containment while rollout is pending.** With a Threat
   Prevention subscription, use Applications and Threats content version
   `8836-8695` or later, enable Threat IDs `95187`, `95189`, and `95191`, and
   ensure the vulnerability protection profile is actually applied to the
   GlobalProtect interface. This is temporary protection, not a replacement
   for the fixed PAN-OS release.
4. **Escalate when documented containment is unavailable.** If the signatures
   cannot be applied correctly, prepare an operator decision to disable or
   isolate the affected GlobalProtect surface until upgrade. Do not make an
   availability-impacting change without the service owner and change authority.
5. **Treat suspected compromise as recovery, not patch management.** Unit 42
   observed activity ranging from unsuccessful probes to configuration-file
   access and interactive command execution. The vendor also documents
   post-exploitation persistence techniques and offers an enhanced factory
   reset (EFR) process through support. A fixed release prevents the initial
   vulnerability; it does not, by itself, establish that a previously
   compromised device is trustworthy.

## The prompt

~~~markdown
Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2024-3400, a critical, known-exploited PAN-OS
GlobalProtect arbitrary-file-creation-to-command-injection vulnerability.
Produce exactly one output:

- A reviewer-ready PR/change request that updates repository-controlled PAN-OS
  release pins, policy/configuration artifacts, safe verification, operator
  upgrade/containment instructions, inventory evidence, and rollback, or
- `TRIAGE.md` when ownership, exposure, evidence preservation, incident
  response, live-device authority, or safe rollout cannot be resolved in this
  repository.

## Rules and guardrails

- Scope only CVE-2024-3400 and directly related PAN-OS version inventory,
  GlobalProtect exposure, Threat Prevention containment, upgrade artifacts,
  safe verification, and incident-response handoff.
- Do not connect to, scan, probe, or mutate a live firewall unless the task
  explicitly grants that exact authority. Repository authority is not appliance
  authority.
- Do not generate or send an exploit payload, crafted cookie, path traversal,
  command string, callback, file-write probe, or proof-of-concept request.
- Do not copy or execute active-request examples from advisories. Verification
  must use version/configuration evidence, policy tests, normal health checks,
  and approved logs.
- Treat TSFs, configuration exports, support bundles, certificates, secrets,
  user data, network topology, serial numbers, and raw logs as sensitive. Do not
  add them to Git or print them in PR logs.
- Do not reboot or upgrade a device with possible exploitation evidence before
  the incident owner decides whether a TSF and other evidence must be collected.
- Do not treat disabled device telemetry as mitigation. Telemetry does not need
  to be enabled for exploitation.
- Do not treat Threat IDs `95187`, `95189`, and `95191` as effective unless the
  required content is present and the vulnerability protection profile is
  applied to the GlobalProtect interface.
- Do not treat prevention signatures as a durable substitute for upgrading.
- Do not declare a device uncompromised because one indicator, log search, or
  alert is absent. Do not erase, clean, or alter suspected artifacts.
- Do not auto-merge, push appliance configuration, trigger failover, reboot,
  rotate credentials, or start an EFR procedure.

## Steps

1. Inventory repository ownership. Search PAN-OS/GlobalProtect image pins,
   Terraform, marketplace definitions, Panorama templates, configuration
   exports, policy-as-code, inventory, runbooks, generated artifacts, CI checks,
   and vulnerability exceptions. Record the files inspected.
2. Build a redacted target matrix with one row per firewall and HA peer:
   owner, product/form factor, customer-managed status, environment, current
   PAN-OS version and evidence date, GlobalProtect gateway/portal state,
   reachability, Threat Prevention content/profile state, desired fixed release,
   and repository control point.
3. Classify each row as one of:
   - `not affected`: an unaffected product/release, or no GlobalProtect gateway
     or portal, with authoritative evidence;
   - `vulnerable and exposed`: affected release plus gateway/portal;
   - `vulnerable with documented temporary containment`: affected release plus
     correctly applied vendor Threat Prevention controls;
   - `unknown`: missing or conflicting product, version, configuration, or
     deployment evidence.
4. Apply the incident-response gate before planning a reboot. Review only
   approved, already-available security evidence. If alerts, logs, support
   findings, or operator reports suggest attempted exploitation or compromise,
   stop routine patch work. Record the need to collect a TSF before reboot,
   preserve external logs, contact Palo Alto Networks support, and engage the
   incident owner. Do not investigate by probing the appliance.
5. For repository-controlled vulnerable targets without a compromise stop:
   - select a currently supported vendor release at or above `10.2.9-h1`,
     `11.0.4-h1`, or `11.1.2-h3`, as applicable, or use an exact older-line
     hotfix threshold listed in the Palo Alto Networks advisory when an approved
     compatibility constraint requires it;
   - update image/release pins, IaC, Panorama templates, inventory policy,
     runbooks, checks, and generated outputs consistently;
   - document HA peer order, compatibility, maintenance window, normal service
     health checks, rollback, and the human operator steps. Do not execute them.
6. If rollout cannot be immediate and the repository controls containment,
   require content `8836-8695` or later, Threat IDs `95187`, `95189`, and
   `95191`, and a vulnerability protection profile applied to the GlobalProtect
   interface. Keep a tracked removal/reevaluation condition after upgrade.
7. Add safe policy and rendering checks that fail when:
   - a controlled GlobalProtect target resolves below its applicable fixed
     threshold;
   - a temporary mitigation omits any required Threat ID, uses older content,
     or is not bound to the GlobalProtect interface;
   - an HA peer or generated deployment artifact remains on an old release;
   - a vulnerability exception lacks owner, expiry, evidence, and fixed target.
8. Validate repository artifacts with their normal schema, formatting, render,
   and policy tests. Verify expected GlobalProtect availability using existing
   non-adversarial health checks only. Record commands and results honestly;
   do not claim a live version or policy was observed unless evidence was
   supplied.
9. Add a PR section named `CVE-2024-3400 operator actions` containing:
   - the redacted target matrix and evidence timestamps;
   - before/after PAN-OS releases and the vendor threshold used;
   - gateway/portal exposure and reachability;
   - Threat Prevention content, IDs, profile, and interface binding;
   - TSF/evidence-preservation decision and incident owner;
   - HA sequencing, maintenance impact, health checks, and rollback;
   - support/EFR handoff if compromise is suspected;
   - remaining actions that require live-device authority.

## TRIAGE.md stop conditions

Stop and produce `TRIAGE.md` instead of a PR when any of these is true:

- No affected firewall, configuration, or deployment artifact is owned by this
  repository.
- Product type, deployed PAN-OS release, HA peer state, GlobalProtect
  gateway/portal state, or effective reachability cannot be proved from
  authoritative evidence.
- Attempted exploitation, unauthorized file activity, possible configuration
  access, unexpected process activity, or other compromise evidence exists.
- Evidence preservation or TSF collection must be decided before a reboot or
  upgrade.
- The selected fixed release/hotfix, marketplace image, plugin compatibility,
  hardware support, HA path, maintenance window, or rollback cannot be
  validated safely.
- Threat Prevention containment is required but the subscription, content,
  Threat IDs, profile, or GlobalProtect interface binding cannot be proved.
- Remediation requires live firewall access, failover, reboot, service outage,
  credential rotation, support-case action, or EFR authority not granted by the
  task.
- Meaningful verification would require a crafted request, exploit behavior,
  public scanning, sensitive-data access, or a destructive test.
- Repository validation fails for unrelated pre-existing reasons; record the
  failures without broadening this change.

`TRIAGE.md` must list the files and evidence inspected, redacted target/owner,
observed and required versions, gateway/portal state, reachability, temporary
mitigation state, compromise concern, TSF-before-reboot decision, blocking
authority or compatibility issue, next responsible human, and required next
action. Do not include TSFs, secrets, full configurations, raw customer logs,
or unredacted network details.
~~~

## Stop conditions

- Suspected attempted exploitation or compromise: preserve evidence, collect a
  TSF before reboot when the incident owner/vendor directs, and hand off to
  Palo Alto Networks support and incident response.
- The repository does not own the affected firewall or its deployment/config
  artifacts.
- Product, PAN-OS version, GlobalProtect gateway/portal state, reachability, HA
  state, or containment cannot be established with authoritative evidence.
- A safe fixed release, supported upgrade path, maintenance window, HA plan, or
  rollback has not been approved.
- The task would require live appliance mutation, an outage, credential
  rotation, active probing, or access to sensitive support artifacts beyond its
  authorization.

In each case, return `TRIAGE.md` with the evidence and ownership fields required
by the prompt. Do not convert an incident-response stop into an ordinary patch
PR.

## Verification - what the reviewer looks for

- Every controlled firewall and HA peer has authoritative, timestamped deployed
  version evidence; desired-state files are not the only proof.
- Each GlobalProtect target resolves to a vendor-supported release at or beyond
  the applicable fixed threshold, including generated artifacts and cloud image
  references.
- Gateway and portal configuration are both checked. A portal-only target is
  not incorrectly dismissed.
- Temporary containment, when present, records content `8836-8695` or later,
  Threat IDs `95187`, `95189`, and `95191`, and the profile binding to the
  GlobalProtect interface.
- The change does not present disabled telemetry as protection and does not
  downgrade to an old unaffected branch.
- HA order, compatibility, service health checks, maintenance impact, rollback,
  and human-only live steps are explicit.
- Possible-compromise evidence causes a TSF/evidence-preservation and
  incident-response handoff before reboot rather than a patch-only outcome.
- Tests are static, policy-based, or normal operational health checks. No
  exploit payload, crafted request, external callback, unauthorized scan, or
  destructive test was used.
- Validation results distinguish what was checked in the repository from what
  an authorized operator must verify on the live appliance.

## Guardrails

- Never store a TSF, full running configuration, private key, credential,
  certificate, raw customer log, or unredacted topology in Git.
- Never probe a public or production GlobalProtect endpoint to confirm the
  issue. Version and configuration evidence are sufficient for remediation.
- Never reboot, fail over, or upgrade before the incident owner decides whether
  pre-reboot evidence is required.
- Never use the absence of one known indicator as proof that a device is clean.
- Never let Threat Prevention containment, a private listener, or disabled
  telemetry become a permanent vulnerability exception.
- Never describe upgrade completion as compromise eradication. Recovery trust
is an incident-response decision.

## Rollback

Do not roll back into NVD-listed exact **10.2.9 / 11.0.4 / 11.1.2 /
11.1.2-h1** or earlier enumerated hotfixes. Do not flatten vendor
vendor **10.2.9-h1 / 11.0.4-h1 / 11.1.2-h3** onto those NVD exact
tags and do not invent a first_patched from the empty GHAD
vulnerabilities list.

## Output contract

Return one of:

- A reviewer-ready PR/change request that inventories every controlled target,
  updates all PAN-OS/image/configuration references to an approved fixed
  release, adds safe policy checks, documents any temporary Threat Prevention
  containment, and supplies a human-reviewed HA upgrade, health-check, rollback,
  evidence-preservation, and operator-action plan.
- `TRIAGE.md` containing the bounded evidence, owner, affected/fixed release,
  GlobalProtect exposure, containment state, compromise concern, TSF decision,
  authority/compatibility blocker, and next action when a safe repository change
  cannot be completed.

The output must state what was verified from repository artifacts, what came
from operator evidence, and what remains unverified. It must not claim that a
live firewall was patched, clean, or protected unless authorized execution
evidence is supplied.

## Watch for

- **Portal-only exposure.** The vendor explicitly includes a GlobalProtect
  portal without a gateway.
- **Stale telemetry guidance.** Disabling device telemetry is not effective and
  telemetry need not be enabled for exploitation.
- **Product-name confusion.** Panorama itself, Prisma Access, and managed Cloud
  NGFW are unaffected, but customer-managed VM-Series and Panorama-managed
  PAN-OS firewalls can still match the exposure conditions.
- **Hotfix comparison mistakes.** Compare against the exact maintenance-line
  threshold, not a hand-written decimal conversion. Palo Alto Networks notes
  that Azure marketplace hotfix naming can encode `11.1.2-h3` as `11.1.203`.
- **Passive HA peers and stale artifacts.** A fixed active peer does not prove
  its partner, disaster-recovery device, template, image, or next replacement
  instance is fixed.
- **Unbound prevention profiles.** Having current Threat IDs on the device is
  not protection unless vulnerability protection applies to the GlobalProtect
  interface.
- **Patch-before-preservation.** Rebooting into the fixed release can make some
  prior-installation logs inaccessible. Resolve TSF collection first when an
  investigation is needed.
- **Patch-only incident closure.** Unit 42 documented configuration-file access
  and interactive command execution, while Palo Alto Networks documents
  possible persistence. A fixed release blocks initial exploitation but does
  not establish recovery trust for an already compromised device.
- **Sensitive evidence in review systems.** TSFs and configuration exports can
  contain secrets and network details; retain them only in approved forensic or
  support channels.

## Related workflow

- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
  - use this first when the scanner record, product ownership, deployed version,
  or GlobalProtect exposure evidence is incomplete.

## References

- Palo Alto Networks security advisory:
  <https://security.paloaltonetworks.com/CVE-2024-3400>
- Unit 42 Operation MidnightEclipse threat brief:
  <https://unit42.paloaltonetworks.com/cve-2024-3400/>
- CISA Known Exploited Vulnerabilities catalog entry:
  <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400>
- NVD record (aggregates the vendor CVSS, CPE, CWE, and KEV metadata):
  <https://nvd.nist.gov/vuln/detail/CVE-2024-3400>

description: Critical PAN-OS GlobalProtect command injection. Confirm exposure, preserve evidence when compromise is possible, and move to a vendor-fixed release.

maturity: stable

model: GPT 5.5 Extra High reasoning

title: CVE-2024-3400 - PAN-OS GlobalProtect command injection

quality: curated

recipe_kind: markdown-override

summary: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.


product: gaizhenbiao/chuanhuchatgpt

vendor: gaizhenbiao

less_than_or_equal: latest

status: affected

version: unspecified

version_type: custom

ecosystem: javascript/npm

metric_type: Secondary

severity: medium

metric_type: Primary

part: a

product: chuanhuchatgpt

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users' browsers, potentially resulting in the hijacking of victims' browsers.

title: Gaizhenbiao Chuanhuchatgpt security vulnerability


product: imartinez/privategpt

vendor: imartinez

default_status: unknown

product: private-gpt

vendor: zylon-ai

ecosystem: software/application

severity: high

product: privategpt

vendor: pribai

status: Analyzed

summary: imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.

title: Pribai Privategpt security vulnerability


summary: In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the `history` files of other users, potentially leading to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the `history` path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files. This issue poses a significant risk as it could allow attackers to obtain sensitive information from the chat history of other users.


default_status: affected

product: WP Prayer

vendor: Unknown

version_type: semver

ecosystem: php/wordpress

vendor: goprayer

summary: The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

title: Goprayer Wp Prayer security vulnerability


summary: The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack


summary: The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks


product: man-group/dtale

vendor: man-group

product: dtale

severity: critical

product: d-tale

vendor: man

summary: man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.


default_status: unaffected

product: DN Footer Contacts

product: dn-footer-contacts

vendor: digireturn

summary: The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

title: Digireturn Footer Contacts Bar security vulnerability


vendor: Dell

product: IPMI

vendor: Intel

version: 2.0, revision 1.1E7

vendor: intel

version: IPMI 2.0, revision 1.1E7

archetype: generic

part: h

status: Deferred

summary: Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.

title: Dell Idrac8 security vulnerability


product: WP STAGING – WordPress Backup, Restore & Migration

vendor: renehermi

summary: The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Renehermi Wp Staging – Wordpress Backup, Restore & Migration security vulnerability


product: Human Resource Information System

vendor: SourceCodester

summary: A vulnerability has been found in SourceCodester Human Resource Information System 1.0 and classified as critical. This vulnerability affects unknown code of the file initialize/login_process.php. The manipulation of the argument hr_email/hr_password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259582 is the identifier assigned to this vulnerability.


severity: low

summary: A vulnerability was found in SourceCodester Human Resource Information System 1.0 and classified as problematic. This issue affects some unknown processing of the file Superadmin_Dashboard/process/addcorporate_process.php. The manipulation of the argument corporate_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259583.


summary: A vulnerability was found in SourceCodester Human Resource Information System 1.0. It has been classified as problematic. Affected is an unknown function of the file Superadmin_Dashboard/process/addbranches_process.php. The manipulation of the argument branches_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259584.


product: Online Courseware

vendor: argie

summary: A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. This vulnerability affects unknown code of the file admin/editt.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259588.


summary: A vulnerability, which was classified as critical, has been found in SourceCodester Online Courseware 1.0. This issue affects some unknown processing of the file admin/saveeditt.php. The manipulation of the argument contact leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259589 was assigned to this vulnerability.


summary: A vulnerability, which was classified as critical, was found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/deactivateteach.php. The manipulation of the argument selector leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259590 is the identifier assigned to this vulnerability.


summary: A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/edit.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259591.


summary: A vulnerability was found in SourceCodester Online Courseware 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/saveedit.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259592.


summary: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been classified as critical. This affects an unknown part of the file admin/deactivatestud.php. The manipulation of the argument selector leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259593 was assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/activatestud.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259594 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Online Courseware 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/activateteach.php. The manipulation of the argument selector leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259595.


summary: A vulnerability classified as critical has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file admin/listscore.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259596.


summary: A vulnerability classified as critical was found in SourceCodester Online Courseware 1.0. Affected by this vulnerability is an unknown functionality of the file admin/activateall.php. The manipulation of the argument selector leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259597 was assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, has been found in SourceCodester Online Courseware 1.0. Affected by this issue is some unknown functionality of the file editt.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259598 is the identifier assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, was found in SourceCodester Online Courseware 1.0. This affects an unknown part of the file addq.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259599.


summary: A vulnerability has been found in SourceCodester Online Courseware 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259600.


product: parisneo/lollms

vendor: parisneo

product: lollms-webui

ecosystem: windows/system

product: lollms

vendor: lollms

summary: A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.

title: Lollms security vulnerability


product: EyouCMS

product: eyoucms

vendor: eyoucms

summary: A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=channel_edit of the component Backend. The manipulation of the argument channel_id leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259612. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Event Management

vendor: PuneethReddyHC

vendor: puneethreddyhc

summary: A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259613 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability classified as problematic has been found in PuneethReddyHC Event Management 1.0. Affected is an unknown function of the file /backend/register.php. The manipulation of the argument event_id/full_name/email/mobile/college/branch leads to cross site scripting. It is possible to launch the attack remotely. VDB-259614 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Wi-Fi Camera

vendor: CP Plus

summary: A vulnerability classified as critical was found in CP Plus Wi-Fi Camera up to 20240401. Affected by this vulnerability is an unknown functionality of the component User Management. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259615. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: parisneo/lollms-webui

summary: A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'apply_settings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities.

title: Lollms Lollms Web Ui security vulnerability


product: Prison Management System

summary: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259630 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /Admin/add-admin.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259631.


summary: A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /Admin/login.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259691.


summary: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /Account/login.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259692.


summary: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Admin/edit_profile.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259693 was assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Prison Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Employee/edit-profile.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259694 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as critical has been found in SourceCodester Prison Management System 1.0. This affects an unknown part of the file /Employee/delete_leave.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259695.


summary: A vulnerability classified as problematic was found in SourceCodester Prison Management System 1.0. This vulnerability affects unknown code of the file /Employee/apply_leave.php. The manipulation of the argument txtstart_date/txtend_date leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259696.


product: SecGate 3600

vendor: Wangshen

summary: A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_keyword_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259701 was assigned to this vulnerability.


product: Laundry Management System

summary: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /karyawan/laporan_filter. The manipulation of the argument data_karyawan leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259702 is the identifier assigned to this vulnerability.


product: Red Hat Enterprise Linux 8

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 8 Advanced Virtualization

product: Red Hat Enterprise Linux 9

part: redhat

summary: A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host.

title: Red Hat Red Hat Enterprise Linux 8 security vulnerability


product: RUGGEDCOM ROX MX5000

vendor: Siemens

product: RUGGEDCOM ROX MX5000RE

product: RUGGEDCOM ROX RX1400

product: RUGGEDCOM ROX RX1500

product: RUGGEDCOM ROX RX1501

product: RUGGEDCOM ROX RX1510

product: RUGGEDCOM ROX RX1511

product: RUGGEDCOM ROX RX1512

product: RUGGEDCOM ROX RX1524

product: RUGGEDCOM ROX RX1536

product: RUGGEDCOM ROX RX5000

product: qemu

vendor: qemu

part: o

vendor: netapp

summary: A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.


product: Mautic

vendor: Mautic

archetype: ssrf

summary: Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.


product: NS-ASG Application Security Gateway

vendor: Netentsec

vendor: netentsec

summary: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add_postlogin.php. The manipulation of the argument SingleLoginId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259711.


product: ns-asg

summary: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/config_Anticrack.php. The manipulation of the argument GroupId leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259712.


summary: A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /admin/config_ISCGroupNoCache.php. The manipulation of the argument GroupId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259713 was assigned to this vulnerability.


summary: A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/add_ikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259714 is the identifier assigned to this vulnerability.


product: Kioware

vendor: Kioware

product: kioware

vendor: kioware

summary: KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.

title: Kioware security vulnerability


summary: In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.

title: Kioware security vulnerability


summary: KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number.

title: Kioware security vulnerability


product: Ant Media Server Community Edition

vendor: Ant Media

summary: Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.

title: Ant Media Ant Media Server Community Edition security vulnerability


product: Laundry Management System

vendor: SourceCodester

summary: A vulnerability has been found in SourceCodester Laundry Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /karyawan/edit. The manipulation of the argument karyawan leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259744.


summary: A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the file /application/controller/Pelanggan.php. The manipulation of the argument jeniskelamin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259745 was assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the file /application/controller/Transaki.php. The manipulation of the argument dari/sampai leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259746 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function laporan_filter of the file /application/controller/Pengeluaran.php. The manipulation of the argument dari/sampai leads to sql injection. The associated identifier of this vulnerability is VDB-259747.


product: PI Asset Framework Client

vendor: AVEVA

vendor: aveva

summary: There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.

title: Aveva Pi Asset Framework Client security vulnerability


product: PI Web API

summary: There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use API XML import functionality with content supplied by an attacker.

title: Aveva Pi Web Api security vulnerability


product: GP Premium

vendor: GeneratePress

product: generatepress

vendor: generatepress

summary: The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Generatepress security vulnerability


product: Enterprise Server

vendor: GitHub

vendor: github

summary: An Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed an attacker to use a deploy key pertaining to an organization to bypass an organization ruleset. An attacker would require access to a valid deploy key for a repository in the organization as well as repository administrator access. This vulnerability affected versions of GitHub Enterprise Server 3.11 to 3.12 and was fixed in versions 3.11.8 and 3.12.2. This vulnerability was reported via the GitHub Bug Bounty program.

title: Github Enterprise Server security vulnerability


product: Modal Window

vendor: Unknown

vendor: wow-company

summary: The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

title: Wow-Company Modal Window security vulnerability


product: Header Footer Code Manager Pro

summary: The Header Footer Code Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: 99Robots Header Footer Code Manager Pro security vulnerability


product: Wow Skype Buttons

summary: The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

title: Wow-Company Wow Skype Buttons security vulnerability


product: Sticky Buttons

summary: The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

title: Wow-Company Sticky Buttons security vulnerability


product: Side Menu Lite

summary: The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks

title: Wow-Company Side Menu Lite security vulnerability


product: Popup Box

summary: The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks

title: Wow-Company Popup Box security vulnerability


product: Herd Effects

summary: The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks

title: Wow-Company Herd Effects security vulnerability


product: Counter Box

vendor: wordpress

summary: The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks

title: Wow-Company Counter Box security vulnerability


product: ArcSight Enterprise Security Manager

vendor: OpenText

product: ArcSight Platform

summary: A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.

title: Opentext Arcsight Enterprise Security Manager security vulnerability


platforms:
Windows
Linux
64 bit

product: iManager

version_type: rpm, exe

product: imanager

vendor: microfocus

summary: Remote Code Execution has been discovered in OpenText™ iManager 3.2.6.0200. The vulnerability can trigger command injection and insecure deserialization issues.


summary: Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation or file disclosure.


platforms: Windows Linux

summary: Server Side Request Forgery vulnerability has been discovered in OpenText™ iManager 3.2.6.0200. This could lead to senstive information disclosure.


archetype: xxe

summary: XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.


summary: Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This vulnerability allows an attacker to manipulate certain parameters to bypass authentication.


summary: File Upload vulnerability in unauthenticated session found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a file without authentication.


product: Exclusive Addons for Elementor

vendor: timstrifler

vendor: exclusiveaddons

summary: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdown Expired Title in all versions up to, and including, 2.6.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Exclusiveaddons Exclusive Addons For Elementor security vulnerability


product: WP Recipe Maker

vendor: brechtvds

vendor: bootstrapped

summary: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Bootstrapped Wp Recipe Maker security vulnerability


product: Schema & Structured Data for WP & AMP

summary: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Magazine3 Schema & Structured Data For Wp & Amp security vulnerability


vendor: netweblogic

vendor: pixelite

summary: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'event', 'location', and 'event_category' shortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: ControlLogix 5580

vendor: Rockwell Automation

product: GuardLogix 5580

product: CompactLogix 5380

vendor: rockwellautomation

ecosystem: operating-system

summary: A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices.

title: Rockwellautomation Controllogix 5580 Firmware security vulnerability


product: Mesmerize Companion

vendor: horearadu

summary: The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Horearadu Mesmerize Companion security vulnerability


product: Country State City Dropdown CF7

vendor: trustyplugins

summary: The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Trustyplugins Country State City Dropdown Cf7 security vulnerability


product: Toshiba Tec e-Studio multi-function peripheral (MFP)

vendor: Toshiba Tec Corporation

version: see the reference URL

vendor: toshibatec

summary: Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL.

title: Toshiba Tec Corporation Toshiba Tec E-Studio Multi-Function Peripheral… security vulnerability


summary: Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL.


summary: Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.


product: ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor

vendor: roxnor

vendor: wpmet

summary: The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_navigation_markup function of the Onepage Scroll module. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

title: Wpmet Elements Kit Elementor Addons security vulnerability


product: ElementsKit Pro

product: elementskit

summary: The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Advanced Toggle widgets. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. CVE-2024-43996 is potentially a duplicate of this issue.

title: Wpmet Elementskit security vulnerability


product: lunary-ai/lunary

vendor: lunary-ai

product: lunary

vendor: lunary

summary: In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists due to the inclusion of single-use tokens in the responses of `GET /v1/users/me` and `GET /v1/users/me/org` API endpoints. These tokens, intended for sensitive operations such as password resets or account verification, are exposed to unauthorized actors, potentially allowing them to perform actions on behalf of the user. This issue was addressed in version 1.2.6, where the exposure of single-use tokens in user-facing queries was mitigated.

title: Lunary security vulnerability


summary: In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently exposed to unauthorized actors. This issue occurs when authenticated users inspect responses from `GET /v1/users/me` and `GET /v1/users/me/org` endpoints. The exposed account recovery hashes, while not directly related to user passwords, represent sensitive information that should not be accessible to unauthorized parties. Exposing these hashes could potentially facilitate account recovery attacks or other malicious activities. The vulnerability was addressed in version 1.2.6.

title: Lunary security vulnerability


summary: An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.

title: Lunary security vulnerability


product: Artifactory Self-Hosted

vendor: JFrog

product: artifactory

vendor: jfrog

summary: JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments.

title: Jfrog Artifactory security vulnerability


product: XProtect VMS

vendor: Milestone Systems

summary: A possible buffer overflow in selected cameras' drivers from XProtect Device Pack can allow an attacker with access to internal network to execute commands on Recording Server under strict conditions.

title: Milestone Systems Xprotect Vms security vulnerability


product: Lunar

vendor: Lunar

summary: Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a secondary process injection into the Lunar application and abuse those rights to access sensitive user information.


product: Red Hat Trusted Profile Analyzer

vendor: Red Hat

vendor: redhat

summary: A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.


product: WSO2 Enterprise Integrator

status: unknown

product: WSO2 API Manager

product: WSO2 Open Banking AM

product: WSO2 Open Banking IAM

product: WSO2 Identity Server as Key Manager

product: WSO2 Identity Server

product: WSO2 Carbon Registry Resources UI

summary: A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users. While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.

title: Wso2 Api Manager security vulnerability


product: WSO2 Carbon User Manager Kernel

summary: An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

title: Wso2 Api Manager security vulnerability


product: Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor

vendor: ultimateblocks

vendor: dotcamp

summary: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitleTag) parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-6362 appears to be a duplicate of this issue.

title: Dotcamp Ultimate Blocks security vulnerability


product: Chrome

vendor: Google

ecosystem: browser

product: chrome

vendor: google

product: fedora

vendor: fedoraproject

summary: Use after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


vendor: averta

summary: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Averta Shortcodes And Extra Features For Phlox Theme security vulnerability


product: Media Library Assistant

vendor: dglingren

vendor: davidlingren

summary: The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Davidlingren Media Library Assistant security vulnerability


summary: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.


product: Country State City Dropdown CF7

vendor: trustyplugins

summary: The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tc_csca_patch_settings function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber access and above, to add states or cities to the dropdown.


product: Smart S80 Management Platform

vendor: Byzoro

vendor: byzoro

summary: A vulnerability was found in Byzoro Smart S80 Management Platform up to 20240317. It has been rated as critical. Affected by this issue is some unknown functionality of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259892. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: Online Event Management System

vendor: Campcodes

vendor: campcodes

summary: A vulnerability classified as critical has been found in Campcodes Online Event Management System 1.0. This affects an unknown part of the file /api/process.php. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259893 was assigned to this vulnerability.


summary: A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of the file /views/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259894 is the identifier assigned to this vulnerability.


summary: A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects some unknown processing of the file /views/process.php. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259895.


summary: A vulnerability, which was classified as problematic, was found in Campcodes Online Event Management System 1.0. Affected is an unknown function of the file /views/index.php. The manipulation of the argument msg leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259896.


summary: A vulnerability has been found in Campcodes Online Event Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259897 was assigned to this vulnerability.


summary: A vulnerability was found in Campcodes Complete Online Student Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file units_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259898 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been classified as problematic. This affects an unknown part of the file students_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259899.


summary: A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file Marks_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259900.


summary: A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file courses_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259901 was assigned to this vulnerability.


summary: A vulnerability classified as problematic has been found in Campcodes Complete Online Student Management System 1.0. Affected is an unknown function of the file attendance_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-259902 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as problematic was found in Campcodes Complete Online Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file academic_year_view.php. The manipulation of the argument FirstRecord leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259903.


product: Church Management System

summary: A vulnerability, which was classified as critical, has been found in Campcodes Church Management System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259904.


summary: A vulnerability, which was classified as critical, was found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259905 was assigned to this vulnerability.


summary: A vulnerability has been found in Campcodes Church Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/delete_log.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259906 is the identifier assigned to this vulnerability.


summary: A vulnerability was found in Campcodes Church Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/admin_user.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259907.


summary: A vulnerability was found in Campcodes Church Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/addTithes.php. The manipulation of the argument na leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259908.


summary: A vulnerability was found in Campcodes Church Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addgiving.php. The manipulation of the argument amount leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259909 was assigned to this vulnerability.


summary: A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_sundaysch.php. The manipulation of the argument Gender leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259910 is the identifier assigned to this vulnerability.


summary: A vulnerability classified as problematic has been found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/admin_user.php. The manipulation of the argument firstname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259911.


summary: A vulnerability classified as problematic was found in Campcodes Church Management System 1.0. This vulnerability affects unknown code of the file /admin/add_visitor.php. The manipulation of the argument mobile leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259912.


product: LoadMaster

vendor: Progress Software Corporation

version: LoadMaster 7.2.55.0 (GA)

version: LoadMaster 7.2.49.0 (LTSF)

version: LoadMaster 7.2.48.11 (LTS)

product: loadmaster

vendor: kemptechnologies

vendor: progress

summary: Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.


summary: Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.

title: Progress Loadmaster security vulnerability


product: Server

vendor: Devolutions

product: Remote Desktop Manager

vendor: devolutions

summary: Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier allows an attacker to access sensitive informations contained in the offline cache file by gaining access to a computer where the software is installed even though the offline mode is disabled.

title: Devolutions Devolutions Server security vulnerability


product: WebToffee WP Backup and Migration

vendor: webtoffee

summary: The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.

title: Webtoffee Backup And Migration security vulnerability


product: Unlimited Elements For Elementor

vendor: unitecms

vendor: unlimited-elements

summary: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

title: Unlimited-Elements Unlimited Elements For Elementor security vulnerability


vendor: Unknown

vendor: getshortcodes

summary: The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

title: Getshortcodes Shortcodes Ultimate security vulnerability


vendor: pr-gateway

vendor: adenion

summary: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Adenion Blog2Social security vulnerability


summary: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: Penci Soledad Data Migrator

vendor: pencidesign

summary: The Penci Soledad Data Migrator plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0 via the 'data' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.

title: Pencidesign Penci Soledad Data Migrator security vulnerability


product: Web Directory Free

vendor: salephpscripts

summary: The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.

title: Salephpscripts Web Directory Free security vulnerability


vendor: themeum

summary: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.

title: Themeum Tutor Lms security vulnerability


product: All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic

vendor: smub

vendor: aioseo

summary: The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Aioseo All In One Seo security vulnerability


vendor: gelform

summary: The Social Link Pages: link-in-bio landing pages for your social media profiles plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_link_pages() function in all versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to inject arbitrary pages and malicious web scripts.

title: Gelform Social Link Pages: Link-In-Bio Landing Pages For Your Social Me… security vulnerability


product: WP Go Maps (formerly WP Google Maps)

vendor: wpgmaps

vendor: codecabin

summary: The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpgmza shortcode in all versions up to, and including, 9.0.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Codecabin Wp Go Maps security vulnerability


product: Custom Field Suite

summary: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Custom Field Suite Project Custom Field Suite security vulnerability


summary: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_content]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

vendor: thimpress

product: learnpress

summary: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Thimpress Learnpress security vulnerability


summary: The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


summary: The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code on the server.


product: Genesis Blocks

vendor: studiopress

vendor: wpengine

summary: The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-3901 is a duplicate of this issue.

title: Wpengine Genesis Blocks security vulnerability


product: Content Blocks (Custom Post Widget)

vendor: vanderwijk

summary: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

title: Vanderwijk Content Blocks security vulnerability


summary: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


product: GoLang

vendor: Go Programming Language

product: Haskel

vendor: Haskell Programming Language

vendor: haskell

product: rust

vendor: rust-lang

product: thephpgroup

vendor: thephpgroup

product: yt-dlp

vendor: nodejs

product: php

vendor: php

summary: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

title: Haskell Process Library security vulnerability


product: Red Hat Enterprise Linux 9

vendor: Red Hat

product: qemu

vendor: qemu

vendor: redhat

summary: A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

title: A flaw was found in QEMU


product: huggingface/transformers

vendor: huggingface

product: transformers

summary: The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the `load_repo_checkpoint()` function of the `TFPreTrainedModel()` class. Attackers can execute arbitrary code and commands by crafting a malicious serialized payload, exploiting the use of `pickle.load()` on data from potentially untrusted sources. This vulnerability allows for remote code execution (RCE) by deceiving victims into loading a seemingly harmless checkpoint during a normal training process, thereby enabling attackers to execute arbitrary code on the targeted machine.

title: Huggingface Transformers security vulnerability


product: mintplex-labs/anything-llm

vendor: mintplex-labs

product: anythingllm

vendor: mintplexlabs

summary: A Denial of Service (DoS) vulnerability exists in the mintplex-labs/anything-llm repository when the application is running in 'just me' mode with a password. An attacker can exploit this vulnerability by making a request to the endpoint using the [validatedRequest] middleware with a specially crafted 'Authorization:' header. This vulnerability leads to uncontrolled resource consumption, causing a DoS condition.

title: Mintplexlabs Anythingllm security vulnerability


summary: A stored Cross-Site Scripting (XSS) vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to perform actions on behalf of the user, such as creating a new admin account or changing the user's password, leading to a complete takeover of the AnythingLLM application. The vulnerability stems from the improper sanitization of user and ChatBot input, specifically through the use of `dangerouslySetInnerHTML`. Successful exploitation requires convincing an admin to add a malicious LocalAI ChatBot to their AnythingLLM instance.


product: langchain-ai/langchain

vendor: langchain-ai

product: langchain

vendor: langchain

summary: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.

title: Langchain security vulnerability