CVE-2024-7159 TOTOLINK A3600R Telnet Service product.ini hard-coded password

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182B20201102. It has been rated as critical. This issue affects some unknown processing of the file /webcste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been...

CVE-2024-7155

TOTOLINK A3300R, version 17.0.0cu.557_B20221024, has a vulnerability in the /etc/shadow.sample file where a hard-coded password is used via an unknown functionality. This enables a local attack with high attack complexity and public disclosure of the exploit. No fixed version is listed in the pro...

GHSA-296Q-RJ83-G9RQ Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

usd-2024-0009 | Reflected XSS in Oveleon Cookiebar Details Advisory ID: usd-2024-0009 Product: Cookiebar Affected Version: 2.X Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Security Risk: HIGH,...

CVE-2024-7117

The CVE-2024-7117 entry describes a SQL injection in MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unknown function in /shift_viewmore.php, triggered by manipulating the id parameter. It is exploitable remotely and exploits have been disclosed publicly. Product uses rolling relea...

PT-2024-38088 · Unknown · Md-Mafujul-Hasan Online-Payroll-Management-System

Name of the Vulnerable Software and Affected Versions: MD-MAFUJUL-HASAN Online-Payroll-Management-System versions up to 20230911 Description: A critical issue was found in the system, affecting an unknown functionality of the file /department viewmore.php. The manipulation of the id argument lead...

CVE-2024-7105 ForIP Tecnologia Administração PABX Lista Ura Page detalheIdUra sql injection

A vulnerability classified as critical has been found in ForIP Tecnologia Administração PABX 1.x. Affected is an unknown function of the file /detalheIdUra of the component Lista Ura Page. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. Th...

CVE-2024-40324

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...

CVE-2024-40324

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...

The massive computer outage over the weekend was not a cyber attack, and I’m not sure why we have to keep saying that

Youre not going to believe this, but there was a lot of misinformation on social media over the weekend after the massive CrowdStrike/Microsoft outage. As airlines cancelled flights, hospitals had to reschedule patients and some companies just flat-out couldnt work on Friday, people were quick to...

CVE-2024-7101

A vulnerability, which was classified as critical, has been found in ForIP Tecnologia Administração PABX 1.x. This issue affects some unknown processing of the file /login of the component Authentication Form. The manipulation of the argument usuario leads to sql injection. The attack may be...

CVE-2024-40324

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...

E-Staff 安全漏洞

E-Staff is a reliable recruiting tool from the Russian company E-Staff for modern integrated solutions for recruiting in servers or in the cloud, with a wide range of integration features with any systems and services. A security vulnerability exists in E-Staff version 5.1. An attacker exploiting...

CVE-2024-40324

CVE-2024-40324: A CRLF injection vulnerability in E-Staff v5.1 allows CR/LF characters in input fields, enabling HTTP response splitting and header manipulation. Affected: E-Staff 5.1. Underlying issue: CRLF injection in input handling. Impact per sources is header-related and could influence res...

Cross-Site Request Forgery in Spina

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/mediafolders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2024-40324

A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...

CrowdStrike Explains Friday Incident Crashing Millions of Windows Devices

Cybersecurity firm CrowdStrike on Wednesday blamed an issue in its validation system for causing millions of Windows devices to crash as part of a widespread outage late last week. "On Friday, July 19, 2024 at 04:09 UTC, as part of regular operations, CrowdStrike released a content configuration...

Improper Response Validation

dnsjava is vulnerable to Improper Response Validation. The vulnerability is due to records in DNS replies not being checked for their relevance to the query, allowing an attacker to respond with RRs from different zones...

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eap_request and eap_response functions.

...

Unspecified Vulnerability in RADIUS Protocol under RFC 2865

RADIUS Protocol under RFC 2865 is an RFC open source networking protocol. A security vulnerability exists in RADIUS Protocol under RFC 2865, which can be exploited by an attacker to modify any valid response Access-Accept, Access-Reject, or Access-Challenge to any other response using a Choice...

Apache CloudStack Security Bypass Vulnerability (CNVD-2024-33812)

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. A security bypass vulnerability exists in Apache CloudStack that stem...