A vulnerability in Synology DiskStation Manager (DSM) prior to versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to bypass authorization via a user-controlled key in the SSOAuth component. This flaw enables attackers to read or write arbitrary files and perform denial-of-service attacks.
An authentication bypass vulnerability exists in the OTP component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers with valid user credentials to bypass authentication controls via an alternate path or channel, enabling them to read or write arbitrary files and perform denial-of-service attacks.
A relative path traversal vulnerability exists in openEuler iSulad on Linux in the oci_load_process_manifest() function, which fails to sanitize the Config path of manifest.json. This flaw allows a malicious tar package to cause the isulad process, running with root privileges, to read arbitrary files on the host system. The vulnerability affects iSulad versions through 2.1.6 and has a CVSS 3.1 score of 7.4 (high severity).
Movable Type by Six Apart Ltd. has a code injection vulnerability in its Dynamic Publishing feature. An attacker can send a crafted request to execute arbitrary PHP code. This vulnerability has a CVSS 3.0 score of 7.3, indicating high severity. No affected versions or patches are specified in the available data.
A symbolic link (symlink) following vulnerability exists in openEuler iSulad on Linux up to version 2.1.6. An attacker who can cause the victim or platform to run a crafted malicious image may exploit this flaw to have the iSulad daemon copy sensitive host directories into an anonymous volume during container creation, allowing the container to read sensitive host data.
A format string vulnerability exists in openEuler iSulad on Linux up to version 2.1.6. The issue occurs when the iSulad daemon reads stderr output from the shim process during container lifecycle operations. If the output contains format specifiers, it may lead to information leakage, denial of service, or arbitrary writes.
A memory leak vulnerability exists in openEuler iSulad on Linux, specifically in the src/daemon/modules/spec/specs_mount.c file. This flaw affects iSulad versions through 2.1.6 and causes the daemon to consume increasing amounts of memory, potentially leading to an out-of-memory (OOM) crash and denial of service (DoS).
An incorrect authorization vulnerability exists in the Security Advisor component of Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1. This flaw allows remote attackers to read specific files without proper authorization. The vulnerability has a medium severity rating with a CVSS score of 5.3.
An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.
A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials
A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page
This Red Hat Security Advisory addresses multiple vulnerabilities in the Apache HTTP Server (httpd) 2.4 package, including heap-based buffer overflows, NULL pointer dereferences, buffer over-reads, and denial of service conditions. The update fixes an incomplete prior fix for CVE-2023-38709 (now CVE-2024-42516) and several new vulnerabilities affecting various modules such as mod_proxy_html, mod_xml2enc, mod_headers, and mod_mime. The advisory is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 8.6 Extended Life Cycle versions.
Akaunting version 3.3.0 contains a stored cross-site scripting (XSS) vulnerability in the custom invoice payment terms feature. An authenticated Manager can inject malicious JavaScript by saving a crafted payment-term value. When another authorized user accesses the Invoice Settings for the same company, the malicious script executes in their browser context, potentially compromising their session and data.
The User Verification by PickPlugins WordPress plugin versions 2.0.38 up to but not including 2.0.49 contains an improper authentication vulnerability. The plugin does not rate limit the one-time-password verification step and does not expire the generated code. This allows unauthenticated attackers to brute force the OTP and log in as any user, including administrators, when the code is configured to use digits only. The issue is fixed in version 2.0.49.
Clockinator Lite WordPress plugin versions before 1.1.0 have an improper access control vulnerability that allows unauthenticated users to update leave requests without authorization. This includes modifying, approving, rejecting, or reassigning leave records.
The Clockinator Lite WordPress plugin versions before 1.1.0 contain an SQL injection vulnerability due to insufficient validation and escaping of user-supplied table names in record deletion actions. This flaw allows unauthenticated attackers to delete data from arbitrary database tables and extract sensitive information such as password hashes. The vulnerability is fixed in version 1.1.0.
The Ultimate Addons for Elementor Forms WordPress plugin before version 1.0.8 contains a vulnerability that allows unauthenticated users to upload arbitrary files, including potentially malicious PHP scripts, due to improper validation of file extensions in its file upload field. This flaw can lead to remote code execution on affected sites.
The Order Tracking WordPress plugin versions before 3.6.2 contain an authorization bypass vulnerability. This flaw allows unauthenticated users to access order histories of all customers and sales representatives by exploiting sequential account numbers and lack of ownership verification. Some versions also expose order contact email addresses. The issue is fixed in version 3.6.2.
The Mine CloudVod WordPress plugin before version 2.6.6 has a vulnerability that allows unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured cloud storage accounts via certain REST API routes. This exposure enables attackers to upload or overwrite files in the site's cloud storage, potentially leading to unauthorized file manipulation.