5742 matches found
D-Link Central WiFi Manager CWM(100) - Remote Code Execution
/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication. id: CVE-2019-13372 info:...
D-Link Central WifiManager - Server-Side Request Forgery
D-Link Central WifiManager is susceptible to server-side request forgery. The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, as demonstrated by an...
N-able N-central < 2026.3.1.10 - Authentication Bypass
N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1...
PT-2026-89475
Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...
nCentralDumpsterDiver
SolarWinds n-Central Dumpster Diver 描述 / 说明 已发布修复/规避方案，更多信息请参见：https://vulners.com/cve/CVE-2020-7984 此应用利用 nCentral 代理的 dot net 库来模拟代理注册，并拉取代理/设备配置设置。这些信息可能包含明文形式的 Active Directory 域凭据。该问题已于 2019 年 10 月 10 日报告给 SolarWinds PSIRT（[email protected]）。在大多数情况下，代理下载 URL 未受保护，任何未经授权的人只要知道客户 ID...
CVE-2026-XXXX-atlassian-email-enumeration
CVE-2026-XXXX：Atlassian Central GraphQL — 电子邮件枚举预言机 产品 Atlassian Central GraphQL 网关 （api.atlassian.com/graphql） 漏洞类型 CWE-204：可观测响应差异 — 电子邮件枚举预言机 严重等级 中危 — CVSS 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 描述 Atlassian 中央 GraphQL 网关上的 loomUnauthenticatedprimaryAuthTypeForEmail GraphQL 查询会根据电子邮件地址是否已在...
Big-IP-Next-CVE-2024-26026
CVE-2024-26026 BIG-IP Next Central Manager API 未认证 SQL 注入 链接：https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...
N-able N-central Pre-Auth RCE Flaw Exploited in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities KEV catalog, requiring Federal Civilian Executive Branch FCEB agencies to apply the fixes by September 11, 2026. The...
CVE-2026-86819
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...
EUVD-2026-74192
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement...
CVE-2026-86819
Waves Central for macOS contains a local privilege escalation in its privileged helper service. The root cause is improper XPC client authentication : the helper validates connecting clients by comparing the caller's code-signing certificate chain for equality with its own, rather than checking a...
CVE-2024-26026
CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...
CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)
Overview While conducting research into a recent N-able N-central authentication bypass vulnerability CVE-2026-18577, Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker ...
N-central - Authentication Bypass
N-central 3 matchers-condition: and matchers: - type: word words: - "SessionID" - "sessionHelloResponse" condition: and - type: status...
N-central - XML External Entities Injection
N-central versions %xxe; rand http: - raw: - | POST /dms/services/ServerUI HTTP/2 Host: Hostname Content-Type: text/xml Soapaction: "" soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope...
N-able N-central Static Code Injection Vulnerability
N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution...
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software...
CVE-2026-85640
Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...