449 matches found
The vulnerability of the Display Manager configuration software lies in the improper handling of the link before accessing the file, allowing an attacker to delete any files they desire.
The vulnerability of the Display Manager configuration software relates to the incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow an attacker to delete any files they desire...
The vulnerability of the microprogrammed software of the three-phase voltage control relay Harmony Control Relay RMNF22TB30 and the Harmony Timer Relay RENF22R2MMW allows a intruder to alter the device’s configuration.
The vulnerability of the microprogrammed voltage-controlled relays Harmony Control Relay RMNF22TB30 and Harmony Timer Relay RENF22R2MMW lies in errors during privilege management. Exploiting this vulnerability could allow an attacker to remotely alter the device’s configuration...
CVE-2024-22663
TOTOLINKA3700RV9.1.2u.616520211012has a command Injection vulnerability via setOpModeCfg...
The vulnerability of the setWanCfg function in the Totolink LR1200GB router’s microprogramming software, which exists due to the lack of measures to neutralize special elements, allows a hacker to execute arbitrary code.
The vulnerability of the setWanCfg function in the Totolink LR1200GB router microprogramming system exists due to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2024-23057
TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function...
Poly Trio Security Feature Issue Vulnerability
Poly Trio is a Trio series business conference phone from Poly USA. A security signature issue vulnerability exists in Poly CCX and Trio that stems from a security signature issue vulnerability in the component Web Configuration Application. Affected products and versions: Poly CCX version 400, C...
Default credentials
On affected platforms running Arista MOS, the configuration of a BGP password will cause the password to be logged in clear text that can be revealed in local logs or remote logging servers by authenticated users, as well as appear in clear text in the device’s running config...
Arista MOS Security Vulnerability
Arista MOS is an operating system from the American company Arista. It is used to provide CLI and Web interfaces as well as support for other management protocols. A security vulnerability exists in Arista MOS that stems from the configuration of BGP passwords that will result in passwords being...
CVE-2022-23830
SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity...
Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the exposeconfig option is set to non-sensitive-only. The exposeconfig option is False by default. It is recommended to upgrade to a...
Deserialization Of Untrusted Data
Apache Airflow Spark Provider is vulnerable to deserialization of untrusted data. The vulnerability occurs when an authorized Airflow user configures Spark hooks on an Airflow node pointing it to a malicious Spark server in an Airflow deployment causing arbitrary code to be run on that Airflow...
CVE-2023-34040
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...
CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers...
PT-2023-22177 · WordPress · Infinitewp Client
Name of the Vulnerable Software and Affected Versions: InfiniteWP Client plugin for WordPress versions up to, and including, 1.11.1 Description: The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure via the admin notice function. This can allow authenticated...
SEIKO EPSON printer Web Config vulnerable to denial-of-service (DoS)
Overview SEIKO EPSON printer Web Config contains a denial-of-service DoS vulnerability due to improper input validation CWE-20. SEIKO EPSON CORPORATION reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and SEIKO EPSON CORPORATION coordinated under the...
CVE-2023-30560
The configuration from the PCU can be modified without authentication using physical connection to the PCU...
Sanitize 跨站脚本漏洞
Sanitize is an HTML and CSS cleaner by Ryan Grove, an individual developer in the United States, which supports removing HTML and CSS from strings, among other things. A cross-site scripting vulnerability exists in Sanitize versions prior to 3.0.0 to 6.0.2, which stems from the presence of a...
CVE-2023-33264
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets...
CVE-2023-33264
CVE-2023-33264 affects Hazelcast through 5.0.4, 5.1–5.1.6, and 5.2–5.2.3, where configuration routines do not mask passwords in the member configuration, allowing Hazelcast Management Center users to view some secrets. Multiple connected sources confirm impact on Hazelcast and variants of product...