CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22315 – IBM Fusion improper communication restriction
https://notcve.org/view.php?id=CVE-2024-22315
28 Jan 2025 — IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection. • https://www.ibm.com/support/pages/node/7179168 • CWE-923: Improper Restriction of Communication Channel to Intended Endpoints •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37962 – WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-37962
10 Jul 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Fusion allows Stored XSS.This issue affects Fusion: from n/a through 1.6.1. The Fusion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi... • https://patchstack.com/database/wordpress/plugin/fusion/vulnerability/wordpress-fusion-page-builder-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-38395
https://notcve.org/view.php?id=CVE-2022-38395
18 Nov 2022 — HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up. HP Support Assistant utiliza HP Performance Tune-up como herramienta de diagnóstico. HP Support Assistant utiliza Fusion para iniciar HP Performance Tune-up. • https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-40165
https://notcve.org/view.php?id=CVE-2021-40165
07 Oct 2022 — A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. Un archivo TIFF, PICT, TGA o RLC diseñado de forma maliciosa en el componente de procesamiento de imágenes de Autodesk puede usarse para escribir más allá del búfer asignado mientras se analizan los archivos TIFF, PICT, TGA o RLC. Esta vulnerabilidad puede ser expl... • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-40163
https://notcve.org/view.php?id=CVE-2021-40163
07 Oct 2022 — A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component. Una vulnerabilidad de corrupción de memoria puede conllevar a una ejecución de código mediante archivos DLL diseñados de forma maliciosa por medio del componente de procesamiento de imágenes de Autodesk • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-40166
https://notcve.org/view.php?id=CVE-2021-40166
07 Oct 2022 — A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability may be exploited by attackers to execute arbitrary code. Un archivo PNG diseñado de forma maliciosa en el componente de procesamiento de imágenes de Autodesk puede usarse para intentar liberar un objeto que ya ha sido liberado mientras es analizado. Esta vulnerabilidad puede ser explotada por atacantes para ejecutar código arbitrari... • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-40162
https://notcve.org/view.php?id=CVE-2021-40162
07 Oct 2022 — A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. Los archivos TIF, PICT, TGA o RLC diseñados de forma maliciosa en el componente de procesamiento de imágenes de Autodesk pueden ser forzados a leer más allá de los límites asignados cuando son analizados los archivos TIFF, PICT, TGA o RLC. Esta vulnerabilidad p... • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-40164
https://notcve.org/view.php?id=CVE-2021-40164
07 Oct 2022 — A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. Podría producirse un desbordamiento del búfer en la región heap de la memoria pila mientras son analizados archivos TIFF, PICT, TGA o RLC. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0011 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22043
https://notcve.org/view.php?id=CVE-2021-22043
16 Feb 2022 — VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files. VMware ESXi contiene una vulnerabilidad TOCTOU (Time-of-check Time-of-use) que se presenta en la forma de manejar los archivos temporales. Un actor malicioso con acceso a settingsd, puede explotar este problema para escalar sus privilegios al escribir archivos arb... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 2CVE-2020-28911 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28911
24 May 2021 — Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. Un Control de Acceso Incorrecto en Nagios Fusion versiones 4.1.8 y anteriores, permite a usuarios autenticados pocos privilegiados extraer las contraseñas usadas para administrar servidores fusionados por medio del comando test_server en el archivo ajaxhelper.php Skylight Cyber has identified a total of 13 vulne... • https://packetstorm.news/files/id/162783 • CWE-922: Insecure Storage of Sensitive Information •