Tenda AC1206 Command Injection Vulnerability (CNVD-2024-41056)

The Tenda AC1206 is a wireless Gigabit router from Tenda China. The Tenda AC1206 suffers from a command injection vulnerability that stems from manipulation of the ateiwprivset/ateifconfigset functions in the file /goform/ate, which can lead to command injection. No detailed vulnerability details...

PT-2024-38010

Name of the Vulnerable Software and Affected Versions lollms-webui affected versions not specified lollms affected versions not specified Description A path traversal issue exists in the lollms file system.py file, specifically affecting the functions add rag database, toggle mount rag database,...

Ghidra data type archive for Windows driver functions

While reverse-engineering Windows drivers with Ghidra, it is common to encounter a function or data type that is not recognized during disassembly. This is because Ghidra does not natively include the majority of the definitions for data types and functions used by Windows drivers. Thankfully,...

SUSE CVE-2024-47672

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2024-40214 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue arises from the order in which permissions are processed, leading to potential leaks of field values or record contents to users without the required permissions. This can occur in...

CVE-2024-47610 Stored Cross-site Scripting Vulnerability in Markdown Editor

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addresse...

WordPress WP Cleanup and Basic Functions Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Cleanup and Basic Functions Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9455 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 039af66fda0d Credits Francesco...

WordPress plugin WP Cleanup and Basic Functions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Vulnerability of loading and downloading functions for microprogramming software of PLANET Technology devices, allowing attackers to bypass authentication processes and execute arbitrary code.

The vulnerability of the loading and downloading functions of microprogramming software from PLANET Technology is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and execute arbitrary code...

CVE-2024-20442

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls on some REST API endpoints. An attacker...

CVE-2024-20442

Cisco Nexus Dashboard exposes a REST API vulnerability due to insufficient authorization controls on certain endpoints. An authenticated, low-privileged, remote attacker could perform limited Administrator actions such as viewing portions of the web UI, generating config backups, or deleting tech...

The vulnerability of the Rockwell Automation Pavilion8 platform for simulation, control, and optimization, related to insecure privilege management, allows a intruder to gain unauthorized access to arbitrary functions.

The vulnerability of the Rockwell Automation Pavilion8 platform for simulation, control, and optimization is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to gain unauthorized access to arbitrary functions...

CVE-2024-28813

An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface...

CVE-2024-28813

An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface...

CVE-2024-8452 PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials

Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially...

CVE-2024-8452 PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials

Certain switch models from PLANET Technology only support obsolete algorithms for authentication protocol and encryption protocol in the SNMPv3 service, allowing attackers to obtain plaintext SNMPv3 credentials potentially...

CVE-2024-28813

An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface...

CVE-2024-28813

The CVE-2024-28813 issue affects Infinera hiT 7300 running 5.60.50, where undocumented privileged functions in the @CT management application allow activation of remote SSH access to the appliance via an unexpected network interface. According to multiple sources (NVD/Red Hat/CVEs, CNNVD, and PT ...

CVE-2024-28813

An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an unexpected network interface...

PT-2024-22585 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the Infinera hiT 7300, where undocumented privileged functions in the @CT management application allow an attacker to activate remote SSH access to the appliance via an...