513 matches found
CVE-2021-40109
A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A user with permissions to upload files from external sites can upload a URL that redirects to an internal resource of any file type. The redirect is followed and loads the contents...
D-link Dcs-932L和D-link Dcs-5000L 安全漏洞
D-link Dcs-5000L is an Ip network surveillance camera. d-link Dcs-932L is a network surveillance camera. d-link DCS-5000L and DCS-932L elevation of privilege vulnerability, an attack to can be exploited to compromise the camera configuration and allow a malicious user on the LAN to access the...
PT-2024-11385
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.9 Description The issue is related to a missing sev decommission in sev receive start, which can result in subsequent SEV launch failures due to firmware memory leaks. According to AMD's SEV API, RECEIVE STA...
Attackers Actively Exploiting Realtek SDK Flaws
Threat actors zeroing in on command injection vulnerabilities reported in Realtek chipsets just days after multiple flaws were discovered in the software developers kits SDK deployed across at least 65 separate vendors. On Aug. 16 multiple Realtek vulnerabilities were disclosed by IoT Inspector...
CVE-2021-3708
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the local network may exploit this, with CVE-2021-3707, to execute any OS commands on the vulnerable device...
CVE-2021-32002 SiteManager troubleshooter allows access without authentication from local network
Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...
Unchecked hostname resolution could allow access to local network resources by users outside the local network
Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...
PT-2021-24355 · Pterodactyl · Pterodactyl Wings
Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.2 Description: An authenticated user with access to a game server can bypass previously implemented access control, potentially accessing resources on local networks that would otherwise be inaccessibl...
Sitel CAP/PRX Information Disclosure Vulnerability
Sitel CAP/PRX is an operating system from Sitel France. It is used for central processing units that have a 180 MHz ARM9 architecture. An information disclosure vulnerability exists in SITEL CAP/PRX firmware 5.2.01, which can be exploited by an attacker to access the device's internal configurati...
Unspecified Vulnerability in Sitel CAP/PRX
Sitel CAP/PRX is an operating system from Sitel France. It is used for central processing units that have a 180 MHz ARM9 architecture. A security vulnerability exists in SITEL CAP/PRX firmware 5.2.01, which can be exploited by an attacker to gain access to the device's local network to obtain...
CVE-2021-32456
SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network of the device to obtain the authentication passwords by analysing the network traffic...
WCMS Server-Side Request Forgery Vulnerability
WCMS is a content management system CMS that uses an open web interface to build websites. A server-side request forgery vulnerability exists in WCMS version 0.3.2. An attacker can send a specially crafted request from the web application's back-end server via the path parameter of wex/cssjs.php,...
Shining a Light on SolarCity: Practical Exploitation of the X2e IoT Device (Part One)
In 2019, Mandiant’s Red Team discovered a series of vulnerabilities present within Digi International’s ConnectPort X2e device, which allows for remote code execution as a privileged user. Specifically, Mandiant’s research focused on SolarCity’s now owned by Tesla rebranded ConnectPort X2e device...
Design/Logic Flaw
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access...
CVE-2020-25173 Reolink P2P Cameras
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access...
CVE-2020-25173
CVE-2020-25173 affects Reolink P2P cameras. Multiple connected sources confirm a fixed cryptography key is exposed, enabling an attacker with local network access to potentially decrypt tokens and compromise cameras beyond the local network. Root cause: hard-coded/fixed cryptographic material. Im...
CVE-2020-25173: Use of Hard-coded Cryptographic Key
An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local network access...
mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
A flaw was found in the mysql-connector-java package. A complicated attack against the mysql Connector/J allows attackers on the local network to interfere with a user's connection and insert unauthorized SQL commands in MySQL Connectors and other products...
Freebox server DNS rebinding vulnerability
The Freebox server is a DSL modem, router, Wi-Fi hotspot, NAS 250 GB hard disk, DECT base with up to 8 connected DECT telephones as well as Digital Video Recorder-T for TNT also known as DVB and IPTV. A security vulnerability exists in Freebox Server versions prior to 4.2.3, which stems from a DN...