3304 matches found
CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3
In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...
CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3
In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead...
CVE-2024-5550
CVE-2024-5550 affects h2oai/h2o-3 3.40.0.4. The Typeahead API allows an arbitrary system path lookup, exposing full filesystem paths (e.g., /home, /usr, /bin) to remote users. This is an information-disclosure flaw; exploitation is potentially facilitated when combined with a Local File Inclusion...
RHEL 7 : spice-gtk (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spice-gtk: Integer overflows causing buffer overflows in spice-client CVE-2017-12194 - The spice-gtk widg...
CVE-2024-22060
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary files into sensitive directories of ITSM server...
CVE-2024-22060
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary files into sensitive directories of ITSM server...
CVE-2022-45171
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions...
CVE-2022-45171
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions...
CVE-2022-45171
CVE-2022-45171 affects LIVEBOX Collaboration vDesk (through v018). The issue is an Unrestricted Upload of a File with a Dangerous Type in the vShare web site section, allowing an authenticated remote user to upload potentially dangerous files without restrictions. The cited sources (NVD/Red Hat e...
CVE-2023-43848
Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as if they were the administrator via HTTP POST request...
CVE-2024-5406
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...
CVE-2024-5405
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...
CVE-2024-5406
CVE-2024-5406 affects WinNMP 19.02, where an XSS flaw exists in the index page via the from, subject, text, and hash parameters. A remote attacker could send a specially crafted query to an authenticated user, potentially stealing session details. The NVD entry lists CVSSv3.1: AV:N/AC:L/PR:N/UI:R...
CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...
CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...
CVE-2024-5405
WinNMP 19.02 contains an XSS vulnerability exploitable via /tools/redis.php, specifically in the k, hash, key, and p parameters. A remote attacker could inject JavaScript to fetch an authenticated user’s session details. The issue is documented across multiple sources (CVE-2024-5405, RH, NVD, CVE...
CVE-2024-5405 Multiple vulnerabilities in WinNMP from Wtriple
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...
CVE-2024-5405 Multiple vulnerabilities in WinNMP from Wtriple
A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...
IRZ RUH2 Insufficient Verification of Data Authenticity (CVE-2016-2309)
iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...
