124 matches found
CVE-2024-31843
An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System...
CVE-2024-31843
An issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users to execute commands on the Operating System...
Italtel Embrace 安全漏洞
Italtel Embrace is a software-only, cloud-enabled Web application server from Italtel. It can be used to enable WebRTC services in a TLC network or as a standalone WebRTC service. A security vulnerability exists in Italtel Embrace version 1.6.4, which originates from not properly checking...
PT-2024-24240 · Italtel · Italtel Embrace
Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: The issue is related to improper input validation in the Web application, allowing authenticated users to execute commands on the Operating System. Recommendations: For Italtel Embrace version 1.6.4,...
CVE-2024-31844
An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside a...
CVE-2024-31845
An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
CVE-2024-31845
An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
CVE-2024-31844
An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside a...
CVE-2024-31840
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current...
CVE-2024-31840
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts cleartext passwords in the HTML source code. An authenticated user is able to edit the configuration of the email server. Once the user access the edit function, the web application fills the edit form with the current...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
CVE-2024-31847
Italtel Embrace 1.6.4 is affected by a stored cross-site scripting (XSS) vulnerability in a GET parameter. The issue allows authenticated or unauthenticated remote attackers to inject arbitrary web script or HTML by reflecting/storing user input without sanitization. Exploitation details are not ...
CVE-2024-31845
An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...
CVE-2024-31845
Italtel Embrace 1.6.4 contains a logging input handling issue: output written to logs is not properly neutralized, with a GET query string parameter being used for log entries. An attacker can modify this parameter to attribute actions to a different user, and the issue is exploitable without aut...
CVE-2024-31845
An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...
CVE-2024-31844
An issue was discovered in Italtel Embrace 1.6.4. The server does not properly handle application errors. In some cases, this leads to a disclosure of information about the server. An unauthenticated user is able craft specific requests in order to make the application generate an error. Inside a...
CVE-2024-31844
Italtel Embrace 1.6.4 is affected. The issue stems from improper server-side error handling, allowing unauthenticated attackers to craft requests that trigger errors and disclose server details (e.g., absolute paths) in error messages. Documented in multiple sources (NVD/Red Hat/CVE records), thi...