CVE-2024-10344: Uncontrolled Resource Consumption

In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service DoS via the refuse function was identified. Reported by Karol Więsek...

CVE-2024-45764

Dell Enterprise SONiC OS, versions 4.1.x, 4.2.x, contains a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell...

CVE-2024-20538

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An...

PT-2024-7957

Name of the Vulnerable Software and Affected Versions Cisco Desk Phone 9800 Series versions prior to the fixed version Cisco IP Phone 7800 Series versions prior to the fixed version Cisco IP Phone 8800 Series versions prior to the fixed version Cisco Video Phone 8875 versions prior to 14.21SR3...

CVE-2024-20371: Undefined Security Weakness

A vulnerability in the access control list ACL programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device. This vulnerability exists because ACL deny rules are not properly...

CVE-2024-48325: Improper Neutralization of Special Elements used in an SQL Command

Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. The "instituicaoid" parameter in "/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicaoid" is not properly sanitized, allowing an...

CVE-2024-20530: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An...

Cisco Enterprise Chat and Email 输入验证错误漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco, USA. The product provides email, chat, and web callback capabilities, among other things, for other Cisco solutions. An input validation error vulnerability exists in Cisco Enterprise Chat and Email...

CVE-2024-42509

ArubaOS/vulnerable Aruba Access Point line affected by CVE-2024-42509, a command-injection in the CLI service that enables unauthenticated remote code execution via PAPI UDP port 8211. Public reports consistently describe this as a high-severity, remote attacker–controlled code execution risk on ...

CVE-2024-47460: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI Aruba's Access Point management protocol UDP port 8211. Successful exploitation of this vulnerability results in the ability ...

PT-2024-33081 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.8.0 Description: The issue concerns a SQL injection vulnerability in the getDocuments function of the InstituicaoDocumentacaoController class. The instituicao id parameter in the...

CVE-2024-10652: Improper Neutralization of Input During Web Page Generation

IDExpert from CHANGING Information Technology does not properly validate a parameter for a specific functionality, allowing unauthenticated remote attackers to inject JavsScript code and perform Reflected Cross-site scripting attacks...

PT-2024-9533 · Servicenow · Servicenow

Name of the Vulnerable Software and Affected Versions: ServiceNow affected versions not specified Description: The issue is related to incorrect code generation management in the Now Platform, which could enable an unauthenticated user to remotely execute code within the context of the Now...

CVE-2024-6049

The web server of Lawo AG vsm LTC Time Sync (vTimeSync) is vulnerable to a "..." (triple dot) path traversal vulnerability (CWE-32). An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request to download arbitrary files from the operating system. This exploita...

CVE-2024-6049 Unauthenticated Path Traversal

The web server of Lawo AG vsm LTC Time Sync vTimeSync is affected by a "..." triple dot path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only...

CVE-2024-20474

A vulnerability in Internet Key Exchange version 2 IKEv2 processing of Cisco Secure Client Software could allow an unauthenticated, remote attacker to cause a denial of service DoS of Cisco Secure Client. This vulnerability is due to an integer underflow condition. An attacker could exploit this...

CVE-2024-20384

A vulnerability in the Network Service Group NSG feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access control list ACL and allow traffic that should be denied to flow...

CVE-2024-20372

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to...

CVE-2024-20410

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to insufficient...

CVE-2024-20407

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are no...