CVE-2024-1309 Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5

Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1...

axhosting.net Improper Access Control vulnerability OBB-3850266

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-0320

CVE-2024-0320 is a Cross-Site Scripting issue in FireEye Malware Analysis (AX) affecting version 9.0.3.936530. The vulnerability allows an attacker to inject a crafted JavaScript payload via the application URL to retrieve a user’s session details. Public details consistently reference this vulne...

CVE-2024-0320: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting in FireEye Malware Analysis AX affecting version 9.0.3.936530. This vulnerability allows an attacker to send a specially crafted JavaScript payload in the application URL to retrieve the session details of a legitimate user...

PT-2024-14303 · Tenda · Tenda Ax3

Name of the Vulnerable Software and Affected Versions: Tenda AX3 version 16.03.12.11 Description: A remote code execution issue was discovered via the list parameter at the "/goform/SetNetControlList" API endpoint. Recommendations: For Tenda AX3 version 16.03.12.11, as a temporary workaround,...

ASUS RT-AX55 Auth Bypass Command Execution

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the failure to take measures to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2020-19318

Buffer Overflow vulnerability in D-Link DIR-605L, hardware version AX, firmware version 1.17beta and below, allows authorized attackers execute arbitrary code via sending crafted data to the webserver service program...

CVE-2020-19318

CVE-2020-19318 affects D-Link DIR-605L (hardware AX; firmware 1.17beta and below). Root cause is a buffer overflow in the webserver service program, allowing an authenticated attacker to remotely execute arbitrary code by sending crafted data. Remediation, where documented, is to upgrade to a fir...

Alert: Active Exploitation of TP-Link, Apache, and Oracle Vulnerabilities Detected

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added three flaws to the Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The security vulnerabilities are as follows - CVE-2023-1389 CVSS score: 8.8 - TP-Link Archer AX-21 Command Injection...

TP-Link Archer AX-21 Command Injection Vulnerability

TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution...

ax-env (>=0.2.2, <=0.3.1), fb-sapp (>=0.5.3, <=0.5.4) +4 more potentially affected by CVE-2022-4899 via zstd (>=1.4.4.0, <=1.5.2.6)

zstd PYPI version =1.4.4.0, =0.2.2, =0.5.3, =0.0.1a0, =1.0.0rc1, =1.3.0 Source cves: CVE-2022-4899 Source advisory: OSV:GHSA-5C9C-6X87-F9VM...

CBL Mariner 2.0 Security Update: kernel (CVE-2022-1204)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1204 advisory. - A use-after-free flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in the way a...

CBL Mariner 2.0 Security Update: kernel (CVE-2022-1205)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1205 advisory. - A NULL pointer dereference flaw was found in the Linux kernel's Amateur Radio AX.25 protocol functionality in...

Tridium Niagara AX Insufficiently Protected Credentials (CVE-2012-3025)

The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network. This plugin only works with Tenable.ot. Please visit...

Tridium Niagara AX Insufficiently Protected Credentials (CVE-2012-4028)

Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

Tridium Niagara Improper Authentication (CVE-2017-16748)

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. This plugin only works with Tenable.o...

Tridium Niagara Enterprise Security, Niagara AX, and Niagara 4 Improper Neutralization of Input During Web Page Generation (CVE-2018-18985)

Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may all...

Tridium Niagara AX Path Traversal (CVE-2012-4027)

Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file. This plugin only works with Tenable.ot. Please visit...

Tridium Niagara AX Path Traversal (CVE-2012-4701)

Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging 1 valid credentials or 2 the guest feature. This plugin only works with Tenable.ot. Please visit...

Tridium Niagara AX Improper Authentication (CVE-2012-3024)

Tridium Niagara AX Framework through 3.6 uses predictable values for 1 session IDs and 2 keys, which might allow remote attackers to bypass authentication via a brute-force attack. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...