PT-2024-6327 · Veeam · Veeam Service Provider Console

Name of the Vulnerable Software and Affected Versions: Veeam Service Provider Console VSPC affected versions not specified Description: A code injection vulnerability allows a low-privileged user with REST API access to remotely upload arbitrary files to the VSPC server, leading to remote code...

PT-2024-3811 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea Secret Server versions prior to 11.7.000001 Description: The issue is related to the use of a hardcoded key for encryption in the Delinea Secret Server, allowing a remote attacker to bypass the authentication procedure. This can be...

PT-2024-20543 · Unknown · Casaos-Userservice

Name of the Vulnerable Software and Affected Versions: CasaOS-UserService versions prior to 0.4.7 Description: The issue concerns a path traversal vulnerability in the UserService API, which allows an unauthorized actor to access any file on the system due to insufficient path filtering for user...

WordPress Plugin Maintenance Mode Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

VulnCheck KEV: CVE-2022-26833

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

OpenJDK: range check loop optimization issue (8314307)

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or...

Volkswagen ID.3 Security Vulnerability

The Volkswagen ID.3 is an all-electric vehicle from Volkswagen Germany. A security vulnerability exists in the Volkswagen ID.3 ICAS 3 IVI ECU that originates from a vulnerability that allows an attacker to cause a denial of service DOS and invoke the spoof volume setting command via the REST API ...

NVIDIA DGX Input Validation Error Vulnerability

NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. The NVIDIA DGX H100 BMC suffers from an input validation error vulnerability that stems from an input validation error vulnerability in the REST service. An attacker could exploit this vulnerability to cause...

UNISOC Chipsets Buffer Error Vulnerability

UNISOC Chipsets is a chipset from China's Purple Spreadtrum UNISOC. A security vulnerability exists in UNISOC Chipsets, which stems from a lack of boundary checking in the urild service, which may result in out-of-bounds writes...

PT-2023-18290 · Unknown · Trusted Execution Environment

Name of the Vulnerable Software and Affected Versions: Trusted Execution Environment affected versions not specified Description: The issue involves memory corruption in the Trusted Execution Environment when the service API is called with an invalid address. Recommendations: At the moment, there...

Oracle Java SE 安全漏洞

Oracle Java SE and Oracle GraalVM are both products of Oracle Corporation.Oracle Java SE is a product for developing and deploying Java applications for desktops, servers, and embedded devices and real-time environments.Oracle GraalVM is a set of on-the-fly compilers written in the Java language...

PT-2023-9279 · D Link · D-Link Dir-2150

Name of the Vulnerable Software and Affected Versions: D-Link DIR-2150 affected versions not specified Description: The issue exists due to the lack of proper validation of a user-supplied string before using it to execute a system call in the SOAP API interface, which listens on TCP port 80 by...

SugarCRM Enterprise SQL注入漏洞

SugarCRM Enterprise is an enterprise version of an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing for different customer needs, managing and distributing sales leads, and enabling information sharing and tracking of sales...

PT-2023-4247 · Sap · Sap Hybris Commerce +1

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud versions HY COM 2105, HY COM 2205, COM CLOUD 2211 SAP Hybris Commerce versions HY COM 2105, HY COM 2205 Description: The issue is related to the implementation of the Omni Commerce Connect OCC API in SAP Commerce Cloud and...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a denial of service issue in the fingerprint old service interface of the HarmonyOS...

PT-2023-17413 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.1.0p27 Checkmk versions prior to 2.2.0b4 Description: The issue is related to insufficient permission checks in the REST API, allowing unauthorized users to schedule downtimes for any host. Recommendations: For...

CVE-2023-24527 Improper Access Control in SAP NetWeaver AS Java for Deploy Service

SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will...

The vulnerability of the SOAP service of the Nighthawk WiFi 6 Router (RAX30) software allows a hacker to execute arbitrary code.

The vulnerability of the SOAP service in the Nighthawk WiFi 6 Router RAX30 microprogramming system lies in the use of uncontrolled format strings. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

SUSE CVE-2008-1515

The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks."...

CVE-2020-18329

An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface...