Vulnerabilidades

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit…

The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.49.2 via the ajax_pmw_get_product_ids() function due to insufficient restrictions on which products can be included. This…

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective…

The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acf_flm_update_template_with_pasted_layout' function in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers to update custom…

Se ha descubierto una vulnerabilidad de inyección en la característica de la API en Digi On-Prem Manager, permitiendo a un atacante con tokens de la API válidos inyectar SQL mediante entrada especialmente diseñada. La API no está habilitada por defecto, y se requiere un token de la API válido para realizar el ataque.

La Gestión de Proyectos, Colaboración en Equipo, Tablero Kanban, Diagramas de Gantt, Gestor de Tareas y Más - el plugin WP Project Manager para WordPress es vulnerable a inyección SQL basada en tiempo a través del parámetro 'completed_at_operator' en todas las versiones hasta la 2.6.26, inclusive, debido a un escape…

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en wpdevelop Booking Manager booking-manager permite XSS Almacenado. Este problema afecta a Booking Manager: desde n/a hasta menor o igual que 2.1.17.

Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en HasThemes WP Plugin Manager wp-plugin-manager permite la falsificación de petición en sitios cruzados. Este problema afecta a WP Plugin Manager: desde n/a hasta menor o igual que 1.4.7.

Vulnerabilidad de autorización faltante en N-Media Frontend File Manager nmedia-user-file-uploader permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Frontend File Manager: desde n/a hasta menor o igual que 23.2.

IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user.

An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges.

A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.

Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write arbitrary files anywhere on disk

Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'first_name' in '/clients/save_contact/'.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/tickets/save'.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'reply_message' in '/messages/reply'.

Las versiones 178100 y anteriores de Zohocorp ManageEngine Applications Manager son vulnerables a una vulnerabilidad de inyección de comandos autenticada debido a la configuración incorrecta en la función de acción “ejecutar programa”.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'.

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in'/projects/save'.

El plugin Fleet Manager para WordPress es vulnerable a cross-site scripting almacenado a través de la configuración de administrador en todas las versiones hasta la 2.5.1, inclusive, debido a la sanitización insuficiente de la entrada y al escape de la salida. Esto hace posible que atacantes autenticados, con permisos…

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.