All CVEs — page 438 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution, due to insufficient file type validation in the Ultra Addons for Contact Form 7 plugin.
The flaw allows unauthenticated attackers to bypass authentication by exploiting the mo_wp_login_intent parameter in the miniOrange OTP plugin, enabling them to log in as any existing administrator account.
The flaw allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator by exploiting a vulnerability in the Groups – Memberships and Access Control plugin for WordPress.
Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting, allowing attackers to execute scripts in the context of a higher-privileged user session.
This flaw allows an authenticated low-privilege user to inject arbitrary web-server configuration lines by exploiting URL validation in froxlor's subdomain redirect feature.
The flaw allows an authenticated customer to exploit a symlink race condition to gain host root and cross-tenant access, due to improper path validation in the data export feature.
The flaw allows an authenticated customer to plant a symlink in the FTP home directory, leading to arbitrary file deletion via the cron task. This can result in cross-tenant data destruction and host denial of service.
The flaw allows an attacker to inject acme.sh options, leading to arbitrary command execution as root during Let's Encrypt certificate renewals.
This flaw involves a TOCTOU race condition in Froxlor's SSH key synchronization, allowing a customer with local shell access to potentially gain root privileges by swapping their SSH directory with a symlink.
Froxlor fails to invalidate existing user sessions, API keys, and 2FA trust cookies when passwords are changed, allowing attackers with hijacked credentials to maintain persistent access even after legitimate users rotate their passwords.
Froxlor incorrectly handles 2FA token validation by storing only numeric user IDs without account type context, allowing customer tokens to be used for administrator accounts with matching IDs. This creates a second-factor bypass vulnerability where attackers can impersonate administrators using valid customer 2FA cookies.
The flaw allows a low-privilege tenant to bypass namespace checks in Kyverno, potentially reading resources from other namespaces using the Kyverno admission controller's ServiceAccount credentials.
The flaw allows namespace tenants to bypass per-namespace restrictions and create objects in other namespaces, leading to potential privilege escalation to cluster admin.