CVE-2024-43390

Phoenix Contact MGUARD firewall devices (FL/TC MGUARD) are affected by a vulnerability involving improper input validation that allows a low-privileged remote attacker to change firewall configuration, including packet forwarding or NAT, via the FW_NAT.IN_IP environment variable, potentially caus...

PT-2024-19168 · Osc +2 · Osc +2

Name of the Vulnerable Software and Affected Versions: osc affected versions not specified Description: The issue allows attackers to manipulate the configuration of osc by injecting special files in .osc into the actual package sources, such as apiurl. This enables the attacker to alter the osc...

CVE-2024-3913

An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup...

PT-2024-28357 · Phoenix Contact · Charx Sec-3100

Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3100 affected versions not specified Description: An unauthenticated remote attacker can use this issue to change the device configuration due to a file being writeable for a short time after system startup...

PHOENIX CONTACT CHARX SEC 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC. An attacker could exploit the vulnerability to change the device configuration. The following products are affected: CHARX SEC-3000, CHAR...

Ab Initio Metadata Hub和Ab Initio Authorization Gateway 安全漏洞

Ab Initio Metadata Hub and Ab Initio Authorization Gateway are both products of Ab Initio, Inc. of the U.S. Ab Initio Metadata Hub is a metadata system.Ab Initio Authorization Gateway is an authorization gateway. A security vulnerability exists in Ab Initio Metadata Hub and Ab Initio Authorizatio...

Multiple vulnerabilities in ZEXELON ZWX-2000CSW2-HN

Overview ZWX-2000CSW2-HN provided by ZEXELON CO., LTD. is a high-speed coaxial modem with wireless LAN functions. ZWX-2000CSW2-HN contains multiple vulnerabilities listed below. Use of hard-coded credentials CWE-798 - CVE-2024-39838 Incorrect permission assignment for critical resource CWE-732 -...

Error: "Could not update master user list" while changing LDAP Config

Error on XenMobile Server- Could not update master user list error: "Could not update master user list" while changing LDAP Config...

PT-2024-19951 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version 9.3 Description: The issue arises from the application's handling of the "/execute code" endpoint, which is intended to be blocked from external access by default. However, attackers can exploit the "/update...

CVE-2021-47369

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix NULL deref in qethclearworkingpoollist When qethsetonline calls qethclearworkingpoollist to roll back after an error exit from qethhardsetupcard, we are at risk of accessing card-qdio.inq before it was allocated by...

CVE-2021-47369 s390/qeth: fix NULL deref in qeth_clear_working_pool_list()

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix NULL deref in qethclearworkingpoollist When qethsetonline calls qethclearworkingpoollist to roll back after an error exit from qethhardsetupcard, we are at risk of accessing card-qdio.inq before it was allocated by...

(Pwn2Own) QNAP TS-464 QR Code Device CRLF Injection Arbitrary Configuration Change Vulnerability

This vulnerability allows remote attackers to make arbitrary changes to configuration on affected installations of QNAP TS-464 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privWizard API endpoints. The issue results from the lack o...

eZ Platform Admin UI Password reset vulnerability

his Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x. The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other...

eZ Platform Password reset vulnerability

This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x. The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other...

GHSA-CG84-55JX-4237 eZ Platform Password reset vulnerability

This Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x. The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other...

PT-2024-14844 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The local web interface provided during the configuration of Arc lacks authentication, making it vulnerable to abuse by local attackers or malware. This could allow a malicious local user or...

OPENSUSE-SU-2024:0119-1 Security update for tinyproxy

This update for tinyproxy fixes the following issues: - Update to release 1.11.2 Fix potential use-after-free in header handling CVE-2023-49606, boo1223746 Prevent junk from showing up in error page in invalid requests CVE-2022-40468, CVE-2023-40533, boo1223743 - Move tinyproxy program to /usr/bi...

GLPI 安全漏洞

GLPI is an open source IT and asset management software from an individual developer. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner...

CVE-2024-2326 Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update

The Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possibl...

Yamaha WLX222 Security Vulnerability

The Yamaha WLX222 is a wireless LAN access point device from Yamaha Corporation Japan. A security vulnerability exists in the Yamaha WLX222 v.24.00.03 and earlier versions, which stems from an active debug code issue that can be exploited by an attacker to execute arbitrary operating system...