PT-2025-4032 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and earlier Description: A control access issue has been identified, allowing an authenticated attacker to exploit the "/embedai/visits/show/" endpoint to obtain information about visits made by other users. The informati...

django: potential denial-of-service vulnerability in IPv6 validation

A flaw was found in the Django framework. Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial of service attack. The undocumented and private functions cleanipv6address and isvalidipv6address were vulnerable, as was the...

PT-2025-4002 · Contec Health · Contec Health Cms8000 Patient Monitor

Name of the Vulnerable Software and Affected Versions: Contec Health CMS8000 Patient Monitor version Description: The issue involves the transmission of plain-text patient data to a hard-coded public IP address when a patient is connected to the monitor. This could lead to a leakage of confidenti...

Virtuozzo Hybrid Server 7.5 Update 7 Hotfix 2 (7.5.7-167)

The Hotfix 2 for Virtuozzo Hybrid Server 7.5 Update 7 provides fixes for the c2v-convert tool. Vulnerability id: PSBM-159914 c2v-convert could fail if the container's template does not match the distribution installed in the container due to actions like Ubuntu's apt dist-upgrade or apt...

CVE-2024-45653

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system...

CVE-2024-45653

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system...

CVE-2024-45653

IBM Sterling Connect:Direct Web Services (IBM) is affected by CVE-2024-45653, with versions 6.0, 6.1, 6.2, and 6.3 exposing sensitive IP address information to authenticated users in responses. The security bulletin notes a CWE-201 issue (insertion of sensitive information into sent data) and a C...

CVE-2024-45653 IBM Sterling Connect:Direct Web Services information disclosure

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system...

BIT-PYTHON-MIN-2021-29921

In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This in some situations allows attackers to bypass access control that is based on IP addresses...

SUSE CVE-2024-56374

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...

CVE-2024-56374

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...

PT-2025-3476 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version V15.03.05.19 Description: The issue is related to a stack overflow in the formSetPPTPServer function when handling the startIP parameter. This can allow a remote attacker to impact the confidentiality, integrity, and...

CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP addres...

PT-2024-36336 · Kurmi · Kurmi Provisioning Suite

Name of the Vulnerable Software and Affected Versions: Kurmi Provisioning Suite version 7.9.0.33 Description: An issue was discovered in the Kurmi Provisioning Suite. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address...

CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP addres...

Overtek OT-E801G 安全漏洞

The Overtek OT-E801G is a network device from Overtek. Overtek OT-E801G OTE801G65.1.1.0 has a security vulnerability that originates from the file /diagping.cmd?action=test&interface=ppp0.1&ipaddr=8.8.8.8%26%26cat%20/etc/passwd& ipversion=4&sessionKey=test causes OS command injection...

CVE-2024-54450

CVE-2024-54450 affects Kurmi Provisioning Suite 7.9.0.33. During authentication, if an X-Forwarded-For header is present, the application records the header-provided IP (potentially forged) instead of the real IP, and may display this fake IP in the user’s My Account popup. The issue is classifie...

CVE-2024-54450

An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the possibly forged IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP addres...

CVE-2024-53850 The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation

The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists by name in GLPI...

CVE-2024-53269

CVE-2024-53269 affects Envoy proxy. The issue occurs when the Happy Eyeballs sorting algorithm processes non-IP addresses in additional_address, causing a crash in the data plane. Root cause: invalid address types fed into the sort. Affected releases: 1.32.1/1.32.0? (per sources: 1.32.2, 1.31.4, ...