WatchGuard Authentication Gateway 安全漏洞

WatchGuard Authentication Gateway WatchGuard Single Sign-On Agent is an authentication gateway from WatchGuard USA. A security vulnerability exists in WatchGuard Authentication Gateway version 12.10.2 and earlier, which stems from improper authorization checking and allows an attacker with networ...

VMware vCenter Server 7.x < 7.0 U3t / 8.x < 8.0.3 U3d Multiple Vulnerabilities (VMSA-2024-0019)

The version of VMware vCenter Server installed on the remote host is 7.x prior to 7.0 U3t or 8.x prior to 8.0 U3d. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2024-0019 advisory: - The vCenter Server contains a heap-overflow vulnerability in the implementation...

VulnCheck KEV: CVE-2024-38812

VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet...

CVE-2024-8890

An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure communication channel from being establish...

CVE-2024-8890

CVE-2024-8890 affects CIRCUTOR Q-SMT devices running firmware 1.0.4. The root issue is that the device only implements the HTTP protocol, preventing a secure channel and enabling an attacker with network access to obtain legitimate credentials or steal sessions. The exploitation context is networ...

CVE-2024-8888

An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network...

CVE-2024-8888

CVE-2024-8888 affects CIRCUTOR Q-SMT, firmware v1.0.4. A token-based web authentication flaw allows token theft with no expiration, enabling unrestricted access to the web application from the network. Root cause: tokens lack expiration, enabling misuse via network captures or locally stored web ...

PT-2024-39300 · Circutor · Circutor Q-Smt

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: An attacker with access to the network where CIRCUTOR Q-SMT is located could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions...

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution...

CIRCUTOR Q-SMT 安全漏洞

CIRCUTOR Q-SMT is an industrial hardware device from CIRCUTOR, Inc. A security vulnerability exists in CIRCUTOR Q-SMT version 1.0.4, which stems from the implementation of the HTTP protocol only, and allows an attacker to access the host network and obtain legitimate credentials or steal sessions...

CVE-2024-38813

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet...

CVE-2024-38813

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet...

CVE-2024-38812

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution...

CVE-2024-38813 Privilege escalation vulnerability

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet...

CVE-2024-38813

CVE-2024-38813 : Privilege-escalation in VMware vCenter Server. A remote attacker with network access could trigger a flaw by sending a specially crafted packet to escalate to root. NVD lists CVSS v3.1 base score 9.8 (CRITICAL) with network access, no user interaction. Related documents also desc...

CVE-2024-38813 Privilege escalation vulnerability

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet...

CVE-2024-38812 Heap-overflow vulnerability

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution...

CVE-2024-38812 Heap-overflow vulnerability

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution...

CVE-2024-38812

The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution. Recent...

CVE-2024-38813

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...