CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

OPENSUSE-SU-2024:13875-1 java-22-openjdk-22.0.1.0-1.1 on GA media

These are all security issues fixed in the java-22-openjdk-22.0.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

Fortinet FortiClient Arbitrary file write as SYSTEM (FG-IR-22-044)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-044 advisory. - An execution with unnecessary privileges vulnerability CWE-250 in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through...

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...

CVE-2024-37037

CVE-2024-37037 concerns a path traversal vulnerability in Schneider Electric Sage RTU devices. The authenticated attacker, with access to the device web interface, can exploit an improper limitation of a pathname to a restricted directory via a crafted HTTP request to corrupt files and impact dev...

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-4610 ARM Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability These types of vulnerabilities are freque...

CVE-2024-29975

creationtimestamp| type| source ---|---|--- 2024-06-05 17:33:54+00:00| published-proof-of-concept| https://t.me/itsecnews/4475 2024-06-06 11:53:03+00:00| seen| https://t.me/CyberSecurityTechnologies/10630 2024-08-22 10:54:43+00:00| seen| Telegram/-neokYhdGAOIq0TWlgd0SgamQXnfg5SD8KVN61CxyDujW6o...

CVE-2024-27776

MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' may allow Unauthenticated RCE...

CVE-2024-27776 MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' may allow Unauthenticated RCE...

CVE-2024-27776 MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' may allow Unauthenticated RCE...

JVN#22182715: Redmine DMSF Plugin vulnerable to path traversal

Redmine DMSF Plugin provided by Kontron contains a path traversal vulnerability CWE-22. Impact When the affected version of the plugin is enabled on the Redmine instance, the logged-in user may obtain or delete arbitrary files on the server within the privilege of the Redmine process. Solution...

Campbell Scientific CSI Web Server

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Exploitable remotely/low attack complexity Vendor : Campbell Scientific Equipment : CSI Web Server Vulnerabilities : Path Traversal, Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

hennweb.de Cross Site Scripting vulnerability OBB-3929995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-40415

creationtimestamp| type| source ---|---|--- 2024-05-22 17:39:21+00:00| published-proof-of-concept| https://t.me/poxek/4051 2024-05-22 21:25:13+00:00| published-proof-of-concept| https://t.me/SEReborn/4775 2026-07-26 02:00:22+00:00| seen| https://t.me/cyberwarehouse/426 2026-07-27 00:00:20+00:00|...

sophieonline.nl Improper Access Control vulnerability OBB-3929739

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

klcrawfishfarms.com Improper Access Control vulnerability OBB-3929696

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

blynk.de Improper Access Control vulnerability OBB-3929610

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

uciimtorino.it Improper Access Control vulnerability OBB-3929589

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...