CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37962 – WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-37962
10 Jul 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Fusion allows Stored XSS.This issue affects Fusion: from n/a through 1.6.1. The Fusion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi... • https://patchstack.com/database/wordpress/plugin/fusion/vulnerability/wordpress-fusion-page-builder-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 2%CPEs: 2EXPL: 0CVE-2022-38395
https://notcve.org/view.php?id=CVE-2022-38395
18 Nov 2022 — HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up. HP Support Assistant utiliza HP Performance Tune-up como herramienta de diagnóstico. HP Support Assistant utiliza Fusion para iniciar HP Performance Tune-up. • https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22043
https://notcve.org/view.php?id=CVE-2021-22043
16 Feb 2022 — VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files. VMware ESXi contiene una vulnerabilidad TOCTOU (Time-of-check Time-of-use) que se presenta en la forma de manejar los archivos temporales. Un actor malicioso con acceso a settingsd, puede explotar este problema para escalar sus privilegios al escribir archivos arb... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.5EPSS: 7%CPEs: 1EXPL: 2CVE-2020-28911 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28911
24 May 2021 — Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. Un Control de Acceso Incorrecto en Nagios Fusion versiones 4.1.8 y anteriores, permite a usuarios autenticados pocos privilegiados extraer las contraseñas usadas para administrar servidores fusionados por medio del comando test_server en el archivo ajaxhelper.php Skylight Cyber has identified a total of 13 vulne... • https://packetstorm.news/files/id/162783 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28909 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28909
24 May 2021 — Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. Los Permisos de Archivo Incorrectos en Nagios Fusion versiones 4.1.8 y anteriores, permiten una Escalada de Privilegios a root por medio de la modificación de los scripts. Los usuarios pocos privilegiados pueden modificar archivos que pueden ser ejecutados por sudo Skylight Cyber has identified a to... • https://packetstorm.news/files/id/162783 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 2CVE-2020-28908 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28908
24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios en nagios Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more. • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28907 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28907
24 May 2021 — Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh. Una comprobación incorrecta del certificado SSL en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios o una Ejecución de Código como root por medio de vectores relacionados con la descarga de un paquete de actualización que no es confiable en upgrade_to_latest.... • https://packetstorm.news/files/id/162783 • CWE-295: Improper Certificate Validation •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-28906 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28906
24 May 2021 — Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root. Los Permisos de Archivo Incorrectos en Nagios XI versiones 5.7.5 y anteriores y Nagios Fusion versiones 4.1.8 y anteriores, permiten una Escalada de Privilegios a root. Los usuarios pocos privilegiados pueden modificar archivos que son incluidos (también se conoce ... • https://packetstorm.news/files/id/162783 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 50%CPEs: 1EXPL: 2CVE-2020-28905 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28905
24 May 2021 — Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. Una Comprobación Inapropiada de la Entrada en Nagios Fusion versiones 4.1.8 y anteriores, permite a un atacante autenticado ejecutar código remoto por medio de una paginación de tabla Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more... • https://packetstorm.news/files/id/162783 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28904 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28904
24 May 2021 — Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code. Una Ejecución con Privilegios Innecesarios en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios como nagios por medio de la instalación de un componente malicioso que contiene código PHP Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include rem... • https://packetstorm.news/files/id/162783 • CWE-269: Improper Privilege Management •