8139 matches found
CVE-2024-6269 Ruijie RG-UAC HTTP POST Request sxh_vpnlic.php get_ip.addr_details command injection
A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. This vulnerability affects the function getip.addrdetails of the file /view/vpn/autovpn/sxhvpnlic.php of the component HTTP POST Request Handler. The manipulation of the argument indevice leads to command injection. T...
CVE-2024-6269
CVE-2024-6269 affects Ruijie RG-UAC 1.0. The vulnerability lives in the HTTP POST handler function get_ip.addr_details in /view/vpn/autovpn/sxh_vpnlic.php, where manipulating the indevice argument enables remote command injection. Public exploit information exists. Affected product behavior and r...
PT-2024-11656 · Kostal · Kostal Piko 1.5-1 Mp Plus Hmi Oem P
Name of the Vulnerable Software and Affected Versions: Kostal PIKO 1.5-1 MP plus HMI OEM p version 1.0.1 Description: The web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting XSS attack on the API endpoint "/file.bootloader.upload.html". The application fails to...
CVE-2024-29390
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done...
CVE-2024-29390
Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done...
Zyxel NAS Multiple Vulnerabilities
The Zyxel NAS is potentially affected by multiple vulnerabilities. - This command injection vulnerability in the 'setCookie' parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request. CVE-2024-29973 - Th...
CVE-2024-37665
An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...
CVE-2024-37665
An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...
CVE-2024-37036
CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configuration parameters are set...
CVE-2024-37036
CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configuration parameters are set...
CVE-2024-37036
CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and particular configuration parameters are set...
CVE-2024-37665
An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...
WEB VIDEO PLATFORM Security Vulnerabilities
WEB VIDEO PLATFORM is a WVP-PRO open source out-of-the-box web video platform implemented based on the GB28181-2016 standard. A security vulnerability exists in WEB VIDEO PLATFORM GB28181 Pro version 2.0, which stems from an access control issue that allows an authenticated attacker to elevate...
CVE-2024-37665
CVE-2024-37665 affects WVP GB28181 Pro 2.0. An access-control flaw lets authenticated attackers escalate privileges to Administrator via a crafted POST request. The CVSS v3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and required privileges Low. No exploitation details ...
PT-2024-4206 · Schneider Electric · Schneider Electric Sage
Name of the Vulnerable Software and Affected Versions: Schneider Electric Sage affected versions not specified Description: The issue is related to a buffer overflow in memory, which could allow a remote attacker to bypass authentication by sending a specially crafted POST request and setting...
CVE-2024-5785
Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...
CVE-2024-5785 Command injection vulnerability in Comtrend router
Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...
CVE-2024-5785 Command injection vulnerability in Comtrend router
Command injection vulnerability in Comtrend router WLD71-T1v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”...