Zyxel NAS Multiple Vulnerabilities

The Zyxel NAS is potentially affected by multiple vulnerabilities. - This command injection vulnerability in the 'setCookie' parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request. CVE-2024-29973 - Th...

Authentication Bypass

@strapi/plugin-users-permissions is vulnerable to Authentication Bypass. The vulnerability is caused due to improper handling of Open Redirects and session tokens being sent as URL query parameters, allowing an unauthenticated attacker to retrieve third-party tokens with one user click...

CVE-2024-3922

The Dokan Pro WordPress plugin (up to and including version 3.10.3) is affected by an unauthenticated SQL Injection via the code parameter due to insufficient escaping and inadequate query preparation. Attacks can append additional SQL to extract data. Remediation: upgrade to 3.11.0 (patch docume...

DoS (Denial of Service) org.apache.commons:commons-configuration2 Dependency in Confluence Data Center and Server

This High severity org.apache.commons:commons-configuration2 Dependency vulnerability was introduced in versions 1.0 of Confluence Data Center and Server. This org.apache.commons:commons-configuration2 Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-28964

Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. A local unauthenticated attacker could potentially exploit this vulnerability, leading to arbitrary code execution in the context of the logged in user. Exploitation of this issu...

CVE-2024-34065

Summary: CVE-2024-34065 affects Strapi’s @strapi/plugin-users-permissions. By abusing two chained issues (Open Redirect and session token in a URL) prior to 4.24.2, an unauthenticated attacker can bypass authentication and obtain a third‑party token. The attack relies on dynamic OAuth callback co...

BIT-SUITECRM-2024-36407 SuiteCRM unauthenticated user password reset on php7

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...

PT-2024-5492

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 Field Service On-Premises version 7 Description The issue is related to weak authentication in Microsoft Dynamics 365, allowing an unauthenticated attacker to elevate privileges over a network. This can enable a remote...

PT-2024-9317 · Microsoft · Groupme

Name of the Vulnerable Software and Affected Versions: GroupMe affected versions not specified Description: An improper access control issue in GroupMe allows an unauthenticated attacker to elevate privileges over a network. This can be achieved by convincing a user to click on a malicious link...

kernel: NULL pointer dereference in nvmet_tcp_execute_request

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service...

CVE-2024-34686

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...

CVE-2024-34686 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...

CVE-2024-34686 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...

CVE-2024-34686

CVE-2024-34686 concerns SAP CRM WebClient UI. The affected component is the SAP CRM WebClient UI, where insufficient input validation allows an unauthenticated attacker to craft a URL embedding a malicious script. When a victim clicks the link, the script runs in the victim’s browser, enabling th...

CVE-2024-22279

Improper handling of requests in Routing Release v0.273.0 and = v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale...

CVE-2024-22279 GoRouter Denial of Service Attack

Improper handling of requests in Routing Release v0.273.0 and = v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale...

CVE-2024-22279 GoRouter Denial of Service Attack

Improper handling of requests in Routing Release v0.273.0 and = v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale...

CVE-2024-22279

CVE-2024-22279 affects Cloud Foundry routing (GoRouter). The issue is an improper handling of requests in Routing Release versions v0.273.0 up to and including v0.297.0, allowing an unauthenticated attacker to degrade service availability at scale (DoS). Affected products: Routing Release and CF ...

CVE-2024-22279 GoRouter Denial of Service Attack

Improper handling of requests in Routing Release v0.273.0 and = v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale...

CVE-2024-36407

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...