VulnCheck KEV: CVE-2022-26833

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

The vulnerability of the Apache Shiro framework, related to defects in pathname restriction for restricted directories, allows attackers to bypass the authentication process.

The vulnerability of the Apache Shiro framework is related to shortcomings in the mechanism for restricting access to restricted directories. Exploiting this vulnerability allows a malicious actor to bypass authentication processes by sending specially crafted requests...

The vulnerability of the Demon Routing Protocol Daemon (RPD) in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a attacker to cause a service failure.

The vulnerability of the Demon Routing Protocol Daemon RPD in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially craft...

Exploit for Improper Authentication in Ivanti Connect_Secure

CVE-2023-46805 An authentication bypass vulnerability in the w...

PT-2024-12820 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kodbox versions 1.43 and earlier Description: An issue in kodbox allows attackers to arbitrarily add Administrator accounts via crafted GET requests. Recommendations: For versions 1.43 and earlier, update to a version that contains a fix for...

Fortinet FortiPAM Resource Management Error Vulnerability

Fortinet FortiPAM is the United States of America Fitta Fortinet, a privilege access control platform. A resource management error vulnerability exists in Fortinet FortiPAM version 1.0, which stems from unrestricted resource allocation. An attacker could exploit this vulnerability to perform a...

The vulnerability of the Reactor Netty HTTP server, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the Reactor Netty HTTP server is related to an uncontrolled resource consumption. Exploiting this vulnerability allows a malicious actor to cause service failures through specially crafted HTTP requests...

The vulnerability of the LinuxMonitorConsole software, which is used for controlling power sources in Voltronic Power ViewPower, allows a hacker to execute arbitrary code.

The vulnerability of the LinuxMonitorConsole software for controlling power supply sources from Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created...

The vulnerability of the RMI software interface for controlling power sources in Voltronic Power View allows a perpetrator to execute arbitrary code.

The vulnerability of the RMI software interface for controlling power sources in Voltronic Power ViewPower is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created...

The vulnerability of the MacMonitorConsole class in the software for controlling power sources of Voltronic Power ViewPower allows a hacker to execute arbitrary code.

The vulnerability of the MacMonitorConsole software class for controlling Voltronic Power ViewPower power sources is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created request...

The vulnerability of the MonitorConsole class in the software for controlling power sources of Voltronic Power ViewPower allows a perpetrator to execute arbitrary code.

The vulnerability of the MonitorConsole class in the software for controlling power supply sources of Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code through a specially created...

CVE-2023-46712

A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests...

CVE-2023-48783

An Authorization Bypass Through User-Controlled Key vulnerability CWE-639 affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other...

CVE-2023-37934

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency...

Privilege escalation

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...

Design/Logic Flaw

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency...

Path traversal

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability CWE-22 in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests...

CVE-2023-49599

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline...

CVE-2023-48252

The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests...

Bosch Nexo cordless nutrunner security breach

Bosch Nexo Cordless nutrunner is a series of cordless tightening wrenches with integrated controls from Bosch Germany. A security vulnerability exists in Bosch Nexo cordless nutrunner. The vulnerability allows an unauthenticated, remote attacker to send a malicious web request containing arbitrar...