3492 matches found
PT-2024-32883 · Ivanti · Ivanti Connect Secure
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: A stack-based buffer overflow in IPsec allows a remote unauthenticated attacker to cause a denial of service. Recommendations: For versions prior to 22.7R2.3, update to version...
PT-2024-27521 · Ivanti · Ivanti Connect Secure
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.3 Description: An out of bounds read allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service. Recommendations: For versions prior to 22.7R2.3, update to...
CVE-2024-22733
TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...
CVE-2024-47575
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4,...
CVE-2024-49211: Improper Neutralization of Input During Web Page Generation
Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...
Archer Platform 安全漏洞
Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in Archer Platform versions prior to 2024.09, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that could allow a remote, unauthenticated attacker ...
Vilo 5 Mesh WiFi System 安全漏洞
Vilo 5 Mesh WiFi System is a wireless system from Vilo. A security vulnerability exists in Vilo 5 Mesh WiFi System version 5.16.1.33 and earlier, which stems from the presence of a buffer overflow vulnerability that could allow a remote, unauthenticated attacker to execute arbitrary code via the...
CVE-2024-40083: Buffer Copy without Checking Size of Input
A Buffer Overflow vulnerabilty in the localappsetroutertoken function of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer...
CVE-2024-40088: Improper Neutralization of Input During Web Page Generation
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request...
CVE-2024-40085: Buffer Copy without Checking Size of Input
A Buffer Overflow vulnerability in the localappsetrouterwan function of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoeusername and pppoepassword fields being larger than 128 bytes in length...
Critical vulnerability in multiple SICK products
A critical vulnerability has been discovered in the .sdd files of several SICK products. This vulnerability could allow a remote, unauthenticated attacker to gain access to the "Authorized Client" user role, potentially impacting the availability and integrity of the affected SICK products. Users...
CVE-2024-7316: Improper Validation of Specified Quantity in Input
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker to cause Denial of Service DoS condition on the product by sending specially crafted packets to TCP port 683, causing an emergency stop...
Ivanti Avalanche < 6.4.5 Multiple Vulnerabilities
The version of Ivanti Avalanche running on the remote host is prior to 6.4.5. It is, therefore, is affected by multiple vulnerabilities : - A NULL pointer dereference in WLAvalancheService allows a remote unauthenticated attacker to crash the service. CVE-2024-47007 - Server-side request forgery...
CVE-2024-6762
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory...
Esri Portal for ArcGIS < Security 2024 Update 2 Multiple Vulnerabilities
The version of Esri Portal for ArcGIS installed is missing Security 2024 Update 2. It is, therefore, affected by multiple vulnerabilities including: - There is a local file inclusion vulnerability in Esri Portal for ArcGIS 11.2. 11.1, 11.0 and 10.9.1 that may allow a remote, unauthenticated...
CVE-2024-47008
Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information...
CVE-2024-47009
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication...
CVE-2024-47011
Ivanti Avalanche is affected by a path traversal vulnerability (CVE-2024-47011) that allows a remote unauthenticated attacker to leak sensitive information in versions prior to 6.4.5. Public disclosures and Red Hat/NVD entries corroborate the issue and indicate that fixes were introduced in later...
CVE-2024-47010
CVE-2024-47010 affects Ivanti Avalanche prior to version 6.4.5, with a path traversal that enables a remote unauthenticated attacker to bypass authentication. The issue is addressed by Ivanti in 6.4.5 (and related advisories), and references indicate follow‑ups for related CVEs (e.g., 6.4.7) addr...
