9464 matches found
Exploit for CVE-2024-22120
Usage bash python exploit.py --ip --sid --hostid --phps...
CVE-2024-6788
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...
CVE-2024-38501
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...
CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...
CVE-2024-6788 Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password...
CVE-2024-38501
CVE-2024-38501 affects Pepperl+Fuchs Device Master ICDM-RX (gateway devices). An unauthenticated remote attacker can exploit a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. The primary sources describe the vul...
CVE-2024-38501 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...
CVE-2024-38501 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...
PT-2024-5994 · Adobe · Commerce
Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1 through 2.4.4-p9 and earlier Description: The issue is related to an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this...
PT-2024-7101 · Phoenix Contact · Phoenix Contact Charx Sec-3000
Name of the Vulnerable Software and Affected Versions: Phoenix Contact CHARX SEC-3000 versions up to 1.6.2 Description: A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user user-app t...
CVE-2024-20443
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...
CVE-2024-20443
Cisco ISE CVE-2024-20443 affects the web-based management interface with stored XSS due to insufficient input validation. An authenticated, low-privilege user could inject malicious scripts into specific pages, potentially executing code in the interface context or accessing browser-based informa...
PT-2024-5722 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this...
(0Day) Microsoft Windows DirectComposition Null Pointer Dereference Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...
(0Day) Microsoft Windows DirectComposition Out-Of-Bounds Read Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within t...
OESA-2024-1933 mysql security update
The MySQLTM software delivers a very fast, multi-threaded, multi-user, and robust SQL Structured Query Language database server. MySQL Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. MySQL is a trademark of Oracle and/or...
PT-2024-9517 · Veeam · Veeam Backup & Replication
Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication versions prior to 12.2 Description: A vulnerability in Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability...
PT-2024-9559 · Veeam · Veeam Backup & Replication
Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over...
Privilege Escalation
langflow is vulnerable to Privilege Escalation. The vulnerability is due to improper validation in the '/api/v1/users' endpoint, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request...