CVE-2024-29184

FreeScout before 1.8.128 is affected by a Stored XSS in the Signature Input Field. The CSP policy (script-src 'self' 'nonce-abcd') blocks inline scripts and nonces, but an attacker bypassed it by uploading a JS file via POST to /conversation/upload and then using the uploaded file’s URL as the sr...

CVE-2024-28521

SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive information via a crafted script to the loginid parameter of the /singlelogin.php component...

CVE-2024-2464 Application users enumeration in CDeX

This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1...

Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2024-1445)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1439)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28521

CVE-2024-28521 affects Netcome NS-ASG Application Security Gateway v6.3.1. A SQL injection in the loginid parameter of the /singlelogin.php component can allow a local attacker to execute arbitrary code and access sensitive information. The published sources consistently reference the same core f...

PT-2024-22452 · Netcome · Netcome Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netcome NS-ASG Application Security Gateway version 6.3.1 Description: The issue allows a local attacker to execute arbitrary code and obtain sensitive information via a crafted script to the loginid parameter of the "/singlelogin.php"...

GHSA-88WC-FCJ9-Q3R9 GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

Summary A stored cross-site scripting XSS vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the GWC Demos Page. Access to...

GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)

Summary A stored cross-site scripting XSS vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's...

Netentsec NS-ASG Application Security Gateway SQL Injection Vulnerability

Netentsec NS-ASG Application Security Gateway is an application security gateway from China Netentsec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from an SQL injection vulnerability in the messagecontent parameter of file...

CVE-2024-2649 Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injection

A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql...

CVE-2024-2649 Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injection

A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql...

CVE-2024-2649

Netentsec NS-ASG Application Security Gateway 6.3 is affected by CVE-2024-2649 due to SQL injection in the /protocol/iscdevicestatus/deleteonlineuser.php endpoint when manipulating the messagecontent parameter. The vulnerability is exploitable remotely, and multiple sources indicate the exploit/p...

CVE-2024-2647

A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated...

CVE-2024-2645

A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is...

CVE-2024-2648 Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection

A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is...

CVE-2024-2648 Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection

A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is...

CVE-2024-2648

CVE-2024-2648 affects Netentsec NS-ASG Application Security Gateway 6.3, where an unknown function in /nac/naccheck.php accepts the username parameter and allows improper neutralization of data within XPath expressions (XPath injection). This enables remote abuse and exploitation once disclosed p...

CVE-2024-2647

CVE-2024-2647 affects Netentsec NS-ASG Application Security Gateway (v6.3). The issue is a SQL injection in the /admin/singlelogin.php endpoint caused by improper handling of the loginId parameter. Attacks can be remote, and disclosures exist publicly. Multiple sources corroborate the vulnerabili...

CVE-2024-2647 Netentsec NS-ASG Application Security Gateway singlelogin.php sql injection

A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated...