449 matches found
CVE-2024-57016
CVE-2024-57016 affects TOTOLINK X5000R, specifically the function setVpnAccountCfg; the vulnerability arises from the user parameter not being properly sanitized in the /web/cgi-bin/cstecgi.cgi endpoint, enabling an OS command injection. Reported details from PT-2025-3382 describe that this could...
WAVLINK AC3000 安全漏洞
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. An external configuration control vulnerability exists in the WAVLINK AC3000, which can be exploited by attackers to cause a privilege bypass...
WAVLINK AC3000 安全漏洞
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. An external configuration control vulnerability exists in the WAVLINK AC3000, which can be exploited by attackers to cause a privilege bypass...
WAVLINK AC3000 安全漏洞
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. An external configuration control vulnerability exists in the WAVLINK AC3000, which can be exploited by attackers to cause a privilege bypass...
CVE-2024-12106
CVE-2024-12106 affects Progress WhatsUp Gold versions before 2024.0.2. The vulnerability is an authentication-bypass-like issue where an unauthenticated attacker can configure LDAP settings through the product, exposing risk to access control and data integrity. Multiple connected sources corrobo...
CVE-2024-52792 Arbitrary config values override in lam
LDAP Account Manager LAM is a php webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via mainmanage.php and confmain.php. This allows setting arbitrary config values...
CVE-2024-52792
LDAP Account Manager (LAM) is a PHP web frontend for managing entries in an LDAP directory. In affected versions, LAM does not sanitize configuration values set through mainmanage.php and confmain.php, allowing an attacker to smuggle arbitrary config values into config.cfg or serverprofile.conf b...
CVE-2024-51175
The CVE-2024-51175 entry concerns the H3C S1526 switch, specifically the S1526.cfg component. A remote attacker can obtain sensitive information from the device due to this vulnerability. Connected sources confirm the affected product and component and the impact (information disclosure). There a...
CVE-2024-55998
CVE-2024-55998 affects Popup Surveys & Polls for WordPress (Mare.io) up to version 1.36. The issue is Missing Authorization caused by incorrectly configured access control security levels, allowing unauthorized access to privileged actions. According to the CVSS 3.1 metrics provided, the base sco...
CVE-2023-36518
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2...
Cisco IP Phones 7910, 7940, and 7960 Incorrect Default Permissions (CVE-2002-0881)
Cisco IP Phone VoIP models 7910, 7940, and 7960 use a default administrative password, which allows attackers with physical access to the phone to modify the configuration settings. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
NetworkManager-libreswan: Local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager NetkworkManager-libreswan, where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading t...
CVE-2024-8036
ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become inaccessible, or allowing the attacker t...
Information Exposure
github.com/opentofu/opentofu is vulnerable to Information Exposure. The vulnerability is due to the static evaluation of module sources, versions and backend configurations. An attacker can expose sensitive variables and locals...
CVE-2024-8039
Improper permission configurationDomain configuration vulnerability of the mobile application com.afmobi.boomplayer can lead to account takeover risks...
CVE-2024-8039
Improper permission configurationDomain configuration vulnerability of the mobile application com.afmobi.boomplayer can lead to account takeover risks...
CVE-2024-8039
Improper permission configurationDomain configuration vulnerability of the mobile application com.afmobi.boomplayer can lead to account takeover risks...
CVE-2024-8039
CVE-2024-8039 corresponds to an improper permission configuration vulnerability in the TECNO/afmobi mobile app com.afmobi.boomplayer, as described across sources (NVD, Red Hat, CVE listings). The root cause is misconfigured permissions within the mobile application, which can lead to account take...