SyroTech SY-GPON-1110-WDONT Information Disclosure Vulnerability (CNVD-2024-34375)

The SyroTech SY-GPON-1110-WDONT is a wireless router from SyroTech. The SyroTech SY-GPON-1110-WDONT suffers from an information disclosure vulnerability that stems from a lack of encryption when storing usernames and passwords in the router's firmware/database. An attacker can exploit this...

CVE-2024-5614

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.29 via the 'pafepostslist' function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and excerpts of...

CVE-2024-41690

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to storing of default username and password credentials in plaintext within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to...

CVE-2024-41688

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due lack of encryption in storing of usernames and passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the...

PT-2024-29511 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the storage of default username and password credentials in plaintext within the router's firmware/database. An attacker with physical...

PT-2024-29512 · Syrotech · Sy-Gpon-1110-Wdont Router

Name of the Vulnerable Software and Affected Versions: SyroTech SY-GPON-1110-WDONT Router affected versions not specified Description: This issue exists due to the storage of FTP credentials in plaintext within the SquashFS-root filesystem associated with the router's firmware. An attacker with...

CVE-2024-38289

A boolean-based SQL injection issue in the Virtual Meeting Password VMP endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input...

CVE-2024-29069

In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image such as icons and...

DEBIAN-CVE-2024-29069

In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image such as icons and...

CVE-2024-29069 snapd will follow archived symlinks when unpacking a filesystem

In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image such as icons and...

CVE-2024-29069

In CVE-2024-29069, snapd versions prior to 2.62 fail to validate the destination of symbolic links when extracting a snap from a squashfs image. This can allow a malicious snap to cause snapd to write the linked destination’s contents into a world-readable directory, enabling an unprivileged user...

CVE-2024-29069

In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image such as icons and...

CVE-2024-29068 snapd non-regular file indefinite blocking read

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files such as pipes or sockets etc. Various file entries within the snap squashfs image such as icons...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

CVE-2024-38289

TurboMeeting (R-HUB) versions through 8.x are affected by a boolean-based SQL injection in the Virtual Meeting Password (VMP) endpoint. The issue allows unauthenticated remote attackers to extract hashed passwords and authenticate via crafted SQL input. Affected software: RHUB TurboMeeting (up to...

The vulnerability of the multimedia extraction function in Cisco WebEx Teams software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the multimedia extraction function in Cisco WebEx Teams software relates to the insecure transmission of requests to internal services. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information using ...

HashiCorp Nomad和HashiCorp Nomad Enterprise 安全漏洞

HashiCorp Nomad and HashiCorp Nomad Enterprise are both products of HashiCorp, Inc. of the U.S. HashiCorp Nomad is a simple and flexible scheduler and orchestrator. HashiCorp Nomad is a simple and flexible scheduler and orchestrator for managing containerized and non-containerized applications at...

CVE-2024-41122

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

CVE-2024-41121

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...