PT-2024-7434 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by improper handling of input data. This can be exploited by a remote attacke...

PT-2024-7433 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions up to 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by a lack of size checking on input data. This can be exploited by a remote...

The vulnerability of Microsoft Teams’ corporate platform for the iOS operating system allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Teams’ operating system on iOS is related to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

PT-2024-22580 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the web interface of the affected software, which contains hidden functionality. This allows a remote authenticated attacker to access reserved information by accessing...

The vulnerability of Google Chrome’s user interface allows a hacker to replace the user interface with a malicious one.

The vulnerability of Google Chrome’s user interface is related to errors in the way information is presented on the user interface. Exploiting this vulnerability can allow a malicious actor to replace the user interface with a specially created HTML page...

The vulnerability of the /cgi-bin/widget_api.cgi file of the Web Management Interface component of the D-Link DNS-320 router’s microprogramming system allows a hacker to disclose confidential information.

The vulnerability of the /cgi-bin/widgetapi.cgi file of the Web Management Interface component of the D-Link DNS-320 router software relates to the disclosure of information. Exploiting this vulnerability could allow an attacker to disclose confidential information by manipulating the...

PT-2024-12109 · Unknown · Cs-Cart Multivendor

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the product data parameter of add/edit product in the administration interface. This enables attackers to execu...

The vulnerability of the application software interface of the backup and recovery software for Veeam Service Provider Console (VSPC) for remote and cloud customers allows a perpetrator to execute arbitrary code.

The vulnerability of the application software interface for data backup and restoration solutions for Veeam Service Provider Console VSPC remote and cloud customers is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. MindsDB has a security vulnerability that stems from the presence of a cross-site scripting XSS vulnerability that allows JavaScript to be executed whenever a user enumerates engines, databases, projects, or datasets tha...

The vulnerability of the Graph Template component of the Centreon IT infrastructure monitoring software’s web interface allows a attacker to execute arbitrary SQL commands.

The vulnerability of the Graph Template component of the Centreon IT infrastructure monitoring software’s web interface is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

The vulnerability in the session_login.cgi script of the Webmin hosting panel and the web interface for Unix-like systems, Usermin, allows attackers to perform cross-site scripting attacks.

The vulnerability in the sessionlogin.cgi script of the Webmin hosting panel and the web interface for Unix-like systems Usermin exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

The vulnerability of the application software interface of the CloudStack software platform for managing virtual machine environments allows a attacker to compromise the confidentiality of the protected information.

The vulnerability of the application software interface of the CloudStack software platform for managing virtual machine environments is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected...

CVE-2022-48883 net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work for child PKEY interfaces because the...

The vulnerability in the billing system interface for Carbon Billing 5 allows a attacker to perform XSS attacks.

The vulnerability of the Carbon Billing 5 billing system interface relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

The vulnerability in the web interface of the LoLLMS WebUI system, which is used for launching and managing large language models in LoLLMS (Lord of Large Language Multimodal Systems), involves an uncontrolled resource consumption. This allows a malicious user to cause a service failure.

The vulnerability in the LoLLMS WebUI web interface, which is used to launch and manage large language models in LoLLMS Lord of Large Language Multimodal Systems, involves an uncontrolled resource consumption during the processing of the end-point opencodeinvscode. Exploiting this vulnerability...

USN-6926-3 linux-azure vulnerabilities

黄思聪 discovered that the NFC Controller Interface NCI implementation in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash...

PT-2024-28400 · Gl.Inet · Mt300N-V2 +19

Name of the Vulnerable Software and Affected Versions: GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 version 4.3.11 GL-iNet products MT3000/MT2500/AXT1800/AX1800/A1300/X300B version 4.5.16 GL-iNet products XE300 version 4.3.16 GL-iNet products E750 version 4.3....

PT-2024-5395 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description: A critical issue affects the sslvpn config mod function of the /vpn/list ip network.php file in the Web Interface component. The manipulation of the template and stylen...

The vulnerability in the web interface of the IBM Security Directory Integrator and IBM Security Verify Directory Integrator software allows a perpetrator to execute arbitrary code and expose sensitive information.

The vulnerability of the web interface of the IBM Security Directory Integrator and the IBM Security Verify Directory Integrator data integration tool is related to the lack of security measures taken to protect the structure of the web pages. Exploiting this vulnerability allows a malicious acto...

The vulnerability in the web interface of the software-defined networking management software HPE Aruba Networking EdgeConnect SD-WAN Orchestrator allows a attacker to execute XSS attacks.

The vulnerability of the HPE Aruba Networking EdgeConnect SD-WAN Orchestrator software’s web interface exists due to the lack of protective measures taken for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...