PT-2024-23537 · Tenda · Tenda Fh1205

Name of the Vulnerable Software and Affected Versions: Tenda FH1205 version 2.0.0.7775 Description: The issue is related to a stack overflow vulnerability in the security parameter from the formWifiBasicSet function. Recommendations: For Tenda FH1205 version 2.0.0.7775, as a temporary workaround,...

Discovery and Basic Configuration Protocol Access Control Error Vulnerability

Discovery and Basic Configuration Protocol is a discovery and basic configuration protocol used by engineering tools and controllers to discover devices, identify device information, and configure device settings such as PROFINET device names, IP addresses, and so on in a PROFINET network. An...

PT-2024-3912

Name of the Vulnerable Software and Affected Versions: Netcat 1C8 CMS affected versions not specified Description: The issue is related to a weakness in the authentication procedure of the automatic data import function in the Netcat 1C8 CMS system. This weakness can be exploited by a remote...

CVE-2021-47179 NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfsmarkmatchinglsegsreturn Commit de144ff4234f changes pnfsreturnlayout to call pnfsmarkmatchinglsegsreturn passing NULL as the struct pnfslayoutrange argument. Unfortunately,...

CVE-2021-47179

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfsmarkmatchinglsegsreturn Commit de144ff4234f changes pnfsreturnlayout to call pnfsmarkmatchinglsegsreturn passing NULL as the struct pnfslayoutrange argument. Unfortunately,...

CVE-2024-27993

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

CVE-2024-27993

The typps Calendarista Basic Edition WordPress plugin (versions 3.0.2 and earlier ) is vulnerable to a Cross-site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability allows for the potential injection of malicious scripts into pages generate...

PT-2024-22191 · Typps · Typps Calendarista Basic Edition

Name of the Vulnerable Software and Affected Versions: Typps Calendarista Basic Edition versions 3.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potential malicious script...

CVE-2024-27993: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

CVE-2024-1606: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful phishing attack for example by tricking users into using a hyperlink pointing to a website controlled b...

VulnCheck KEV: CVE-2024-27993

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through = 3.0.2...

CVE-2024-1462

The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode...

BIT-GITLAB-2021-39890

It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above...

Login form doesn't get disabled when option is disabled from authentication methods

h3. Issue Summary When we remove the option to authenticate with username and password from the login form we could still use basic authentication to login. This is reproducible on Data Center: Yes h3. Steps to Reproduce Step-1. Remove the option to authenticate with username and password from th...

CVE-2024-21915

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform FTSP. If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read an...

DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

A newly disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-day by an advanced persistent threat actor called Water Hydra aka DarkCasino targeting financial market traders. Trend Micro, which began tracking the campaign in late December 2023, said it entails...

CVE-2024-24935

Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...

CVE-2024-24935

Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WpSimpleTools Basic Log Viewer.This issue affects Basic Log Viewer: from n/a through 1.0.4...

CVE-2024-24935

CVE-2024-24935 is a CSRF vulnerability in the WordPress plugin WpSimpleTools Basic Log Viewer (Basic Log Viewer). Affected version range is up to and including 1.0.4 . The CVE entry notes a CSRF risk that could enable unauthorized actions, but the provided connected documents indicate the vulnera...