CVE-2023-50977

A flaw was found In gnome-shell. The GNOME Network Manager and GNOME Shell Portal Helper connectivity checks send DNS checks that, if intercepted, may be used to launch a GNOME Captive Portal in a WebKitGTK browser and load arbitrary HTML and Javascript code. Mitigation Mitigation for this issue ...

esMind MosP 安全漏洞

esMind MosP is an open source attendance management system from esMind. A security vulnerability exists in esMind MosP kintai kanri 4.6.6 and prior versions, which stems from incorrect privilege assignments and could allow an unauthenticated, remote attacker with privileged access to the product ...

(Pwn2Own) TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vulnerability. However, devices are vulnerable only if configured to use the Comexe DDNS service. The specific fl...

Cisco Firepower Management Center 安全漏洞

Cisco Firepower Management Center FMC is the next-generation firewall management center software from Cisco. A security vulnerability exists in Cisco Firepower Management Center version 1.0, which stems from a vulnerability that could allow an unauthenticated, remote attacker to bypass access...

CVE-2024-20361: Undefined Security Weakness

A vulnerability in the Object Groups for Access Control Lists ACLs feature of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense FTD Software. This...

nodejs: CONTINUATION frames DoS

A vulnerability was found in how Node.js implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated, remote attacker to send packets to vulnerable servers, which...

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 CVSS score: N/A, concerns a cas...

CVE-2024-20369

CVE-2024-20369 affects Cisco Crosswork Network Services Orchestrator (NSO) Web UI. The issue is improper input validation of a parameter in an HTTP request, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and be redirected to a malicious website. Documented...

PT-2024-4562 · Cisco · Cisco Asyncos

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to condu...

CVE-2024-20392: Improper Neutralization of CRLF Sequences in HTTP Headers

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to t...

CVE-2024-31467

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI Aruba's Access Point management protocol UDP port 8211. Successful exploitation of these vulnerabilities resul...

CVE-2024-31472

Summary: Aruba InstantOS/ArubaOS versions prior to 10.5.1.0 are affected by a command-injection vulnerability in the Soft AP Daemon exposed via the PAPI UDP port 8211, enabling unauthenticated remote code execution as a privileged OS user. Affected software: Aruba InstantOS/ArubaOS (pre-10.5.1.0)...

CVE-2024-31471

CVE-2024-31471 describes a command-injection vulnerability in Aruba’s Central Communications service (PAPI UDP port 8211) that can allow unauthenticated remote code execution as a privileged OS user. The PT-2024-24103 report confirms the issue relates to the Central Communications service with af...

CVE-2024-31469

The CVE-2024-31469 issue affects Aruba’s Central Communications service (PAPI UDP port 8211) and enables buffer overflow conditions that could allow unauthenticated remote code execution, resulting in arbitrary code execution as a privileged OS user. Available connected documents confirm the unde...

CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol

There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI Aruba's Access Point management protocol UDP port 8211. Successful exploitation of these vulnerabilities resul...

CVE-2024-33495

A vulnerability has been identified in SIMATIC RTLS Locating Manager 6GT2780-0DA00 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA10 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA20 All versions V3.0.1.1, SIMATIC RTLS Locating Manager 6GT2780-0DA30 All versions...

CVE-2024-32737

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "querycontractresult" function within MCUDBHelper...

CVE-2024-32738

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptasklean" function within MCUDBHelper...

CVE-2024-32739

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryptaskverbose" function within MCUDBHelper...

CVE-2024-32736

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. An unauthenticated remote attacker can leak sensitive information via the "queryutaskverbose" function within MCUDBHelper...