CVE-2024-31471

CVE-2024-31471 describes a command-injection vulnerability in Aruba’s Central Communications service (PAPI UDP port 8211) that can allow unauthenticated remote code execution as a privileged OS user. The PT-2024-24103 report confirms the issue relates to the Central Communications service with af...

CVE-2024-31469

The CVE-2024-31469 issue affects Aruba’s Central Communications service (PAPI UDP port 8211) and enables buffer overflow conditions that could allow unauthenticated remote code execution, resulting in arbitrary code execution as a privileged OS user. Available connected documents confirm the unde...

CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI Aruba's Access Point management protocol UDP port 8211. Successful exploitation of these vulnerabilities resul...

CVE-2024-33495

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-32739

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptaskverbose" function within MCUDBHelper...

CVE-2024-32737

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "querycontractresult" function within MCUDBHelper...

CVE-2024-32738

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptasklean" function within MCUDBHelper...

CVE-2024-32736

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryutaskverbose" function within MCUDBHelper...

CVE-2024-33498

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-33495

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-33494

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-33494

CVE-2024-33494 concerns Siemens SIMATIC RTLS Locating Manager products (multiple 6GT2780 variants). Connected sources confirm a vulnerability where affected components do not properly authenticate heartbeat messages, enabling an unauthenticated remote attacker to impact the availability of second...

CVE-2024-33494

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-30207

The CVE-2024-30207 entry describes vulnerabilities in Siemens SIMATIC RTLS Locating Manager components (multiple SKUs: 6GT2780-0DA00/0DA10/0DA20/0DA30 and 6GT2780-1EA10/1EA20/1EA30) where communications between client and server rely on symmetric cryptography with a hard-coded key. The underlying...

CVE-2024-28134 PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series

An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additional user interaction is required. The access is limited as...

TinyWeb Security Vulnerability

TinyWeb is a simple and lightweight HTTP server from the individual developer Konstantin Belyalov. A security vulnerability exists in TinyWeb version 1.94 and earlier, which originates from a denial of service that allows an unauthenticated, remote attacker to send too large an element in a reque...

RHEL 6 : openslp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openslp: memory corruption due to possible overflow in SLPFoldWhiteSpace in common/slpcompare.c...

CVE-2024-32739 CyberPower PowerPanel Enterprise SQL Injection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptaskverbose" function within MCUDBHelper...

CVE-2024-32738 CyberPower PowerPanel Enterprise SQL Injection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptasklean" function within MCUDBHelper...

PT-2024-4531 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description: A sql injection vulnerability exists in the software, allowing an unauthenticated remote attacker to leak sensitive information via the query utask verbose function within...