Intumit SmartRobot Conversational AI Platform 安全漏洞

Intumit SmartRobot Conversational AI Platform is a conversational AI platform from Intumit. A security vulnerability previously existed in Intumit SmartRobot Conversational AI Platform version v7.2.0, which stemmed from an improper code generation control issue in Groovy script functions. An...

CVE-2024-55342

A file upload functionality in Piranha CMS version 11.1 allows authenticated remote attackers to upload a crafted PDF file to the /manager/media endpoint. This file can contain malicious JavaScript that executes when a victim user opens or interacts with the PDF in a web browser, resulting in a C...

CVE-2024-55342: Improper Neutralization of Input During Web Page Generation

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS...

CVE-2024-9154

CVE-2024-9154 is a code-injection vulnerability in HMS Networks Ewon Flexy 205 that allows executing commands at the system level on the device. Affected product: Ewon Flexy 205 (firmware up to 14.8s0). The issue is described as enabling authenticated remote code execution with impact to confiden...

CVE-2024-9154 Authenticated Remote Code Execution

A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 2633...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

CVE-2024-54663

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

CVE-2024-54663: Inclusion of Functionality from Untrusted Control Sphere

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration ZCS 9.0 and 10.0 and 10.1. A Local File Inclusion LFI vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requir...

CVE-2024-54663

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) versions 9.0, 10.0, and 10.1 . The flaw is located in the /h/rest endpoint, where an authenticated remote attacker can include and access sensitive files within the WebRoot directory by craft...

CVE-2024-48889

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiManager Cloud version 7.4.4 and below,...

PT-2024-9736

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.6.0, 7.4.4 and below, 7.2.7 and below, 7.0.12 and below, 6.4.14 and below FortiManager Cloud versions 7.4.4 and below, 7.2.7 to 7.2.1, 7.0.12 to 7.0.1 Description The issue is related to an Improper Neutralization of...

CVE-2024-48889: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiManager version 7.6.0, version 7.4.4 and below, version 7.2.7 and below, version 7.0.12 and below, version 6.4.14 and below and FortiManager Cloud version 7.4.4 and below,...

CVE-2024-53281

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Network WOL functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users to read or write specific files containing non-sensitive information and conduct...

CVE-2024-51773

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote Attacker to conduct a stored cross-site scripting XSS attack. Successful exploitation could enable a threat actor to perform any actions the user is authorized t...

PT-2024-34901 · Hewlett Packard · Hpe Aruba Networking Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: HPE Aruba Networking ClearPass Policy Manager affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack...

CVE-2024-51771: Improper Neutralization of Special Elements used in a Command

A vulnerability in the HPE Aruba Networking ClearPass Policy Manager web-based management interface could allow an authenticated remote threat actor to conduct a remote code execution attack. Successful exploitation could enable the attacker to run arbitrary commands on the underlying operating...

Exploit for Cross-site Scripting in Sensaphone Web600_Firmware

SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-Sep...

CVE-2024-38644

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later...

CVE-2024-33439

The Kasda LinkSmart Router KW5515 (v1.7 and before) is vulnerable to a command injection vulnerability. An authenticated remote attacker can exploit this issue by leveraging cgi parameters to execute arbitrary operating system commands. The impact includes potential high levels of unauthorized ac...

CVE-2024-33439: Improper Neutralization of Special Elements used in a Command

An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters...