Asterisk 安全漏洞

Asterisk is an Asterisk open source software for PBX systems that runs on Linux and supports IP calls using SIP, IAX, and H323 protocols. Asterisk has a security vulnerability that stems from the fact that an AMI user with write=originate can change all configuration files in the /etc/asterisk/...

CVE-2024-2359

The CVE concerns parisneo/lollms-webui v9.3. An OS command injection stems from improper neutralization, enabling remote code execution. Affected component: the host/config handling in the runtime; attacker-controlled host via the /update_setting endpoint bypasses the intended protection on /exec...

Important: Red Hat Security Advisory: unbound security update

An update for unbound is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

UBUNTU-CVE-2024-23333

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When th...

PT-2024-19815

Name of the Vulnerable Software and Affected Versions LDAP Account Manager LAM versions prior to 8.7 Description LDAP Account Manager LAM is a web frontend for managing entries stored in an LDAP directory. LAM's log configuration allows specifying arbitrary paths for log files. An attacker could...

NetApp StorageGRID Cross-Site Scripting Vulnerability

NetApp StorageGRID is a suite of object storage solutions from Network Appliance NetApp. A security vulnerability exists in NetApp StorageGRID versions prior to 11.8. An attacker could exploit the vulnerability to view or modify configuration settings or add/modify user accounts...

Microsoft Graphics Component Information Disclosure Vulnerability

Microsoft Graphics Component is a graphics driver component from Microsoft Corporation USA. An information disclosure vulnerability exists in Microsoft Graphics Component msgraph-sdk-php that originates from a vulnerability that allows an attacker to craft HTTP requests to be able to access syste...

PT-2023-28093 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to an Uncontrolled Search Path Element vulnerability, which allows for Leveraging/Manipulating Configuration File Search Paths. This vulnerability enables access to the...

C-First DVR Security Breach

C-First DVR is a digital video recorder from C-First. A security vulnerability exists in the C-First DVR that stems from the system's use of hard-coded passwords, which could allow an unauthenticated, remote attacker to rewrite or gain access to the configuration information of the affected...

PT-2023-30368 · First · Cfr-4Eab +4

Name of the Vulnerable Software and Affected Versions: First Corporation's DVRs versions of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB affected versions not specified, but updates are provided only for Late models Description: The issue is related to a hard-coded password in...

PT-2023-13434 · Lenovo · Lenovo Printers

Name of the Vulnerable Software and Affected Versions: Lenovo Printers affected versions not specified Description: The issue allows standard users to directly operate and set printer configuration information, such as IP, in some Lenovo Printers without having to authenticate with the...

Multiple vulnerabilities in multiple FURUNO SYSTEMS wireless LAN access point devices in ST(Standalone) mode

Overview Wireless LAN access point devices provided by FURUNO SYSTEMS Co.,Ltd., running in STStandalone mode, contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2023-39222 Cross-site Scripting CWE-79 - CVE-2023-39429 Cross-Site Request Forgery CWE-352 - CVE-2023-4108...

CVE-2023-20186

A vulnerability in the Authentication, Authorization, and Accounting AAA feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to bypass command authorization and copy files to or from the file system of an affected device using the Secure Copy...

CVE-2022-4039

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server...

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar, related to authentication deficiencies, allows attackers to gain access to the configuration of the cloud-based platform.

The vulnerability of the cloud-based messaging and streaming communication platform Apache Pulsar is related to deficiencies in authentication mechanisms. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the configuration of the cloud-based platfo...

PT-2023-4122 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.5 Description: The issue is related to a path traversal vulnerability in the implementation of the SFTP protocol, which can be exploited by an attacker to write arbitrary files. This can be achieved by using a...

Fujitsu network devices Si-R series 授权问题漏洞

The Fujitsu network devices Si-R series is a router from Fujitsu, Japan. A security vulnerability exists in the Fujitsu Si-R series and SR-M series, which originates from an authentication bypass vulnerability. An attacker could exploit this vulnerability to obtain, change, or reset the...

PT-2023-22788 · Pcu · Pcu

Name of the Vulnerable Software and Affected Versions: PCU affected versions not specified Description: The configuration of the PCU can be modified without authentication by establishing a physical connection to the device. Recommendations: At the moment, there is no information about a newer...

PT-2023-25335 · Ysoft · Ysoft Safeq 6 Server

Name of the Vulnerable Software and Affected Versions: YSoft SAFEQ 6 Server versions prior to 6.0.82 Description: An issue was discovered in YSoft SAFEQ 6 Server where modifying the URL of the LDAP server configuration from LDAPS to LDAP does not require the password to be reentered. This results...

The vulnerability of the Cloudflare WARP for Windows client, related to access control deficiencies, allows attackers to execute connection and disconnection commands for WARP, as well as obtain network diagnostic information and application configurations.

The vulnerability of Cloudflare WARP for Windows relates to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute connection and disconnection commands for WARP, as well as obtain diagnostic information and application configurations...