9347 matches found
CVE-2024-7801 SQL injection in get_chart_data in TimeProvider 4100
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip TimeProvider 4100 Data plot modules allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-7801 SQL injection in get_chart_data in TimeProvider 4100
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip TimeProvider 4100 Data plot modules allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
org.springmodules:spring-modules-xt (0.6) potentially affected by CVE-2024-47855 via net.sf.json-lib:json-lib (0.8)
net.sf.json-lib:json-lib MAVEN version 0.8 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.json-lib:json-lib and may be impacted: - org.springmodules:spring-modules-xt 0.6 Source cves: CVE-2024-47855 Source advisory: OSV:GHSA-WWCP-26WC-3FXM...
org.jvnet.hudson.main:hudson-core (>=1.92, <=1.100), org.jvnet.hudson.main:hudson-war (>=1.92, <=1.100) +1 more potentially affected by CVE-2024-47855 via net.sf.json-lib:json-lib (1.0.1)
net.sf.json-lib:json-lib MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.json-lib:json-lib and may be impacted: - org.jvnet.hudson.main:hudson-core =1.92, =1.92, =1.100 - org.springmodules:spring-modules-xt 0.8a Source cves:...
PT-2024-30613 · Microchip · Timeprovider 4100
Name of the Vulnerable Software and Affected Versions: Microchip TimeProvider 4100 versions 1.0 through 2.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. The...
PT-2024-30612
Name of the Vulnerable Software and Affected Versions Microchip TimeProvider 4100 versions 1.0 through 2.4.7 Description The issue is related to improper authentication in the login modules of Microchip TimeProvider 4100, which allows session hijacking. Recommendations For versions 1.0 through...
CVE-2024-43686: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Microchip TimeProvider 4100 data plot modules allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-43687: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Microchip TimeProvider 4100 banner config modules allows Cross-Site Scripting XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-9054: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 Configuration modules allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before...
CVE-2024-43685: Insufficient Session Expiration
Improper Authentication vulnerability in Microchip TimeProvider 4100 login modules allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-7801: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip TimeProvider 4100 Data plot modules allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-7824 Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit wrUrl.Dll modules allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3...
CVE-2024-7824 Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit wrUrl.Dll modules allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3...
CVE-2024-7825 Type confusion that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type 'Type Confusion' vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit wrUrl.Dll modules allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3...
jackson-modules-java8:DatatypeFuzzer: Security exception in DatatypeFuzzer.fuzzerTestOneInput
Detailed Report: https://oss-fuzz.com/testcase?key=5158179032334336 Project: jackson-modules-java8 Fuzzing Engine: libFuzzer Fuzz Target: DatatypeFuzzer Job Type: libfuzzerasanjackson-modules-java8 Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
Metasploit Weekly Wrap-Up 09/27/2024
Epic Release! This week's release includes 5 new modules, 6 enhancements, 4 fixes and 1 documentation update. Among the new additions, we have an account take over, SQL injection, RCE, and LPE! Thank you to all the contributors who made it possible! New Module Content 5 Cisco Smart Software Manag...
The FIPS Compliance of HKDF
HKDF is an HMAC-based key-derivation function specified in RFC 5869. It’s nice and we generally like using it. FIPS Federal Information Processing Standards is used generally as a moniker for the set of standards, recommendations, and guidance published by the U.S. National Institute of Standards...
CVE-2024-8668: Improper Neutralization of Input During Web Page Generation
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input...
org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2024-38809 via org.springframework:spring-web (2.0.3)
org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...
