ABB Cylon Aspect 3.08.01 networkDiagAjax.php Remote Network Utility Execution Vulnerability

ABB Cylon Aspect version 3.08.01 allows an unauthenticated attacker to perform network operations such as ping, traceroute, or nslookup on arbitrary hosts or IPs by sending a crafted GET request to networkDiagAjax.php. This could be exploited to interact with or probe internal or external systems...

DEBIAN-CVE-2024-49863

In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhostscsigetreq Since commit 3f8ca2e115e5 "vhost/scsi: Extract common handling code from control queue handler" a null pointer dereference bug can be triggered when guest sends an SCSI AN...

Cisco ATA 190 安全漏洞

The Cisco ATA 190 is an analog telephone adapter from Cisco USA. A security vulnerability exists in the Cisco ATA 190 that originates when the HTTP server allows state changes in GET requests. An unauthenticated, remote attacker could exploit this vulnerability to modify the configuration or rebo...

CVE-2024-48624

In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting XSS vulnerability...

CVE-2024-48624

In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scripting XSS vulnerability...

CVE-2024-48623

In queue\index.php of DomainMOD below v4.12.0, the listid and domainid parameters in the GET request can be exploited to cause a reflected Cross Site Scripting XSS...

Backdoor.Win32.Delf.yj MVID-2024-0693 Information Disclosure

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/f991c25f1f601cc8d14dca4737415238.txt Contact: [email protected] Media: x.com/malvuln Threat: Backdoor.Win32.Delf.yj Vulnerability: Information Disclosure Description: The malware listens on...

CVE-2024-44893

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request...

CVE-2024-44893

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request...

CVE-2024-44893

An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET request...

PT-2024-6374 · D Link · D-Link Di-8300

Name of the Vulnerable Software and Affected Versions: D-Link DI-8300 version 16.07.26A1 Description: The issue is related to the msp info htm function in the D-Link DI-8300 router's firmware, which is vulnerable to command injection. This vulnerability can be exploited by a remote attacker to...

GHSA-4JCV-VP96-94XR MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

Summary DNS rebinding is a method of manipulating resolution of domain names to let the initial DNS query hits an address and the second hits another one. For instance the host make-190.119.176.200-rebind-127.0.0.1-rr.1u.ms would be initially resolved to 190.119.176.200 and the next DNS issue to...

PT-2024-6372 · D Link · D-Link Di-8300

Name of the Vulnerable Software and Affected Versions: D-Link DI-8300 version 16.07.26A1 Description: The issue is related to the upgrade filter asp function in the D-Link DI-8300 router's firmware, which does not properly sanitize input data. This can be exploited by a remote attacker to execute...

Microsoft IIS Shortname Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft IIS shortname vulnerability scanner', 'Description' = %q The vulnerability is caused by a tilde character "" in a GET or OPTIONS reques...

Motorola WR850G 4.03 Credentials

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Motorola WR850G v4.03 Credentials', 'Description' = %q Login credentials to the Motorola WR850G router with firmware v4.03 can be obtained via a...

WordPress Shield Security 20.0.5 Cross Site Scripting

Exploit Title: CVE-2024-7313 - Reflected XSS to Unauthorised Administrator Account Creation Google Dork: inurl:"/wp-content/plugins/wp-simple-firewall/" Cannot find version numbers from this DORK Date: 16/08/2024 Exploit Author: Tim Lepp Vendor Homepage: https://getshieldsecurity.com/ Software...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

PT-2024-29475 · Unknown · Aml Surety Eco

Name of the Vulnerable Software and Affected Versions: AML Surety Eco versions up to 3.5 Description: The issue allows an attacker to run arbitrary code via a crafted GET request using the id parameter. This is a Cross Site Scripting XSS issue. Recommendations: For AML Surety Eco versions up to...

AML Surety Eco 安全漏洞

AML Surety Eco is an end-to-end BSA/AML ecosystem from AML. A security vulnerability exists in AML Surety Eco version 3.5 and earlier, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to run arbitrary code via a specially crafted GET request...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...