JVN#61635834: Multiple vulnerabilities in SHARP routers

SHARP routers contain multiple vulnerabilities listed below. OS command injection vulnerability in the HOST name configuration screen CWE-78 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 CVE-2024-45721 The hidden debug function is enabled CWE-489...

Ivanti Connect Secure 安全漏洞

Ivanti Connect Secure is a secure remote network connection tool from Ivanti USA. Ivanti Connect Secure suffers from an out-of-bounds read vulnerability that stems from a lack of proper authentication of user-supplied data in IPsec, which can be exploited by an attacker to cause a denial of servi...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

The provided connected documents identify CVE-2024-10511 as an Improper Authentication (CWE-287) vulnerability in Schneider Electric PowerChute Serial Shutdown. The issue can cause Denial of Access to the PCSS web UI when a local-network attacker repeatedly requests the /accessdenied endpoint. Af...

QNAP QuTS hero Multiple Vulnerabilities (QSA-24-49)

QNAP QuTS hero is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero"; ifdescriptio...

Script Injection

Tuned is vulnerable to a script injection vulnerability. The vulnerability is due to improper authentication in the instancecreate D-Bus function, which allows locally logged-in users to execute arbitrary scripts with absolute paths. Attackers can use this to escalate privileges by executing...

Vulnerabilities fixed in QNAP operating systems

QNAP has fixed vulnerabilities in several versions of their operating systems, including QTS and QuTS hero. The vulnerabilities include improper authentication, certificate validation issues, incorrect URL encryption, CRLF injection and command injection. These vulnerabilities allowed attackers t...

[SECURITY] [DLA 3989-1] ruby-doorkeeper security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3989-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk December 09, 2024 https://wiki.debian.org/LTS -...

Debian dla-3989 : ruby-doorkeeper - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3989 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3989-1 [email protected] https://www.debian.org/lts/security/...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-0130

CVE-2024-0130 affects NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI. The issue is an improper authentication vulnerability triggered by a malformed request over the Ethernet management interface, potentially enabling privilege escalation, data tampering, denial of service, and information...

CVE-2024-0130

NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges,...

CVE-2024-48859

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 bui...

Devolutions Remote Desktop Manager Multiple Vulnerabilities (DEVO-2024-0016)

The remote installation of Devolutions Server is affected by Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an authenticated user to bypass the MFA validation via data source switching. CVE-2024-11671 Note th...

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

The U.S. Cybersecurity and Infrastructure Security Agency CISA added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of...

Siemens Scalance S Improper Authentication (CVE-2012-1799)

The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password. Thi...

Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8380)

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...