90 matches found
CVE-2024-25011
Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue...
CVE-2025-8531
The CVE-2025-8531 affects Mitsubishi Electric MELSEC-Q Series CPU modules (Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, Q26UDPVCPU) with serial numbers starting with the first five digits between 24082 and 27081. The vulnerability arises from improper...
CVE-2024-25011
Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue...
CVE-2024-25011 Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability
Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue...
CVE-2024-25011 Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability
Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue...
Ericsson Catalog Manager和Ericsson Order Care 安全漏洞
Ericsson Catalog Manager and Ericsson Order Care are both products of Ericsson, a Swedish company.Ericsson Catalog Manager is a service management platform.Ericsson Order Care is an order management system. A security vulnerability exists in Ericsson Catalog Manager and Ericsson Order Care that...
PT-2025-38311
Name of the Vulnerable Software and Affected Versions Ericsson Catalog Manager and Ericsson Order Care APIs affected versions not specified Description Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default, leading to an information disclosure issue...
CVE-2025-24322
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability...
CVE-2025-24322
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability...
CVE-2025-24322
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability...
CVE-2025-24322
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability...
CVE-2025-24322
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted network request can lead to arbitrary code execution. An attacker can browse to the device to trigger this vulnerability...
CVE-2025-24322
CVE-2025-24322 affects Tenda AC6 V5.0 V02.03.01.110 where the Initial Setup Authentication has an unsafe default configuration. A specially crafted network request can lead to arbitrary code execution, and an attacker can trigger this by browsing to the device. Connected sources (Talos blog, Red ...
PT-2025-34044 · Tenda · Tenda Ac6
Name of the Vulnerable Software and Affected Versions: Tenda AC6 version V02.03.01.110 Description: An unsafe default authentication issue exists in the Initial Setup Authentication functionality. A specially crafted network request can lead to arbitrary code execution. An attacker can access the...
Tenda AC6 V5.0 missing initial setup authentication vulnerability
Talos Vulnerability Report TALOS-2025-2163 Tenda AC6 V5.0 missing initial setup authentication vulnerability August 20, 2025 CVE Number CVE-2025-24322 SUMMARY An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A...
CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...
CVE-2025-8943
Flowise CVE-2025-8943 affects Flowise versions before 3.0.1. The vulnerability resides in the Custom MCPs feature, specifically the /api/v1/node-load-method/customMCP endpoint, where insufficient authentication/authorization allows unauthenticated network attackers to execute OS commands unsandbo...
CVE-2025-8284
By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users to access and manipulate monitoring and control functions...
Pilz IndustrialPI 访问控制错误漏洞
Pilz IndustrialPI is a gateway for the Industrial Internet of Things from Pilz Individual Developers in Germany. An access control error vulnerability exists in Pilz IndustrialPI that stems from the default unconfigured NodeRED server authentication leading to command execution...