4057 matches found
CVE-2021-32002 SiteManager troubleshooter allows access without authentication from local network
Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network information and configuration of the SiteManager. This issue affects: Secomea SiteManager All versions prior to 9.5 on Hardware...
CVE-2021-35482
An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution with user privileges of the local user on any device that tries to connect to a WePresent presentation system...
PT-2021-20927
Name of the Vulnerable Software and Affected Versions: Barco MirrorOp Windows Sender versions prior to 2.5.4.70 Description: An issue allows an attacker in the local network to achieve Remote Code Execution with user privileges of the local user on any device that tries to connect to a WePresent...
CVE-2021-35482: Undefined Security Weakness
An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution with user privileges of the local user on any device that tries to connect to a WePresent presentation system...
CVE-2021-0292: Uncontrolled Resource Consumption
An Uncontrolled Resource Consumption vulnerability in the ARP daemon arpd and Network Discovery Protocol ndp process of Juniper Networks Junos OS Evolved allows a malicious attacker on the local network to consume memory resources, ultimately resulting in a Denial of Service DoS condition...
PT-2021-3714
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions prior to 19.4R2-S3-EVO Juniper Networks Junos OS Evolved versions prior to 20.1R2-S4-EVO Juniper Networks Junos OS Evolved all versions of 20.2-EVO Description An Uncontrolled Resource Consumption...
CVE-2021-30201
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed external entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type:...
CVE-2021-30201
CVE-2021-30201 affects Kaseya VSA (on‑premises/server side) where the API /vsaWS/KaseyaWS.asmx processes XML with external entities. The vulnerability arises from insecure handling of XML external entities, allowing an attacker to cause the server to read local files (e.g., c:\kaseya\kserver\kser...
CVE-2020-24141
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the fileremote parameter to download-add.php. It can help identify open ports, local network hosts and execute...
CVE-2020-24142
Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...
Server side request forgery (ssrf)
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the fileremote parameter to download-add.php. It can help identify open ports, local network hosts and execute...
Server side request forgery (ssrf)
Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...
CVE-2020-24142
Server-side request forgery in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hos...
Huawei WATCH Kid input validation error vulnerability
Huawei WATCH Kid, a children's watch from Huawei China, is vulnerable to an input validation error in version 1.0.0.608, which can be exploited by a remote attacker on a local network to add a user as a friend without prompting in the target device. A remote attacker could use this vulnerability ...
Huawei WATCH Kid 输入验证错误漏洞
Huawei WATCH Kid, a children's watch from Huawei China, is vulnerable to an input validation error in version 1.0.0.608, which can be exploited by a remote attacker on a local network to add a user as a friend without prompting in the target device. A remote attacker could use this vulnerability ...
GHSA-6RG3-8H8X-5XFV Unchecked hostname resolution could allow access to local network resources by users outside the local network
Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...
Unchecked hostname resolution could allow access to local network resources by users outside the local network
Impact A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This...
PT-2021-24355 · Pterodactyl · Pterodactyl Wings
Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.2 Description: An authenticated user with access to a game server can bypass previously implemented access control, potentially accessing resources on local networks that would otherwise be inaccessibl...
Information disclosure
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and other sensitive information...