PLANET switch devices 资源管理错误漏洞

PLANET switch devices are a series of switch devices from PLANET China. A resource management error vulnerability exists in PLANET switch devices, which stems from a denial of service vulnerability in the swctrl service that allows an unauthenticated, remote attacker to send crafted packets causi...

CVE-2024-8175

An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS...

CVE-2024-45032

A vulnerability has been identified in Industrial Edge Management Pro All versions V1.9.5, Industrial Edge Management Virtual All versions V2.3.1-1. Affected components do not properly validate the device tokens. This could allow an unauthenticated remote attacker to impersonate other devices...

CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection

An unauthenticated remote attacker can run malicious c code included in curve files and execute commands in the users context...

CVE-2024-8584

CVE-2024-8584 affects Orca HCM by LEARNING DIGITAL and is described as a Missing Authentication vulnerability that allows an unauthenticated remote attacker to create an administrator account and log in. CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8) indicates a critical imp...

CVE-2024-6449

HyperView Geoportal Toolkit (versions

CVE-2024-5849

An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once...

CVE-2024-39791

Stack-based buffer overflow vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated remote attacker to execute arbitrary code...

CVE-2024-29082 Vonets WiFi Bridges Improper Access Control

Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprotected goform endpoints...

CVE-2024-41161

Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication using hard-coded administrator credentials. These accounts cannot be...

nghttp2: CONTINUATION frames DoS

A vulnerability was found in how nghttp2 implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which...

Heap-based buffer overflow vulnerability in SonicOS IPSec VPN

Heap-based buffer overflow vulnerability in the SonicOS IPSec allows an unauthenticated remote attacker to cause Denial of Service DoS. CVE: CVE-2024-40764 Last updated: Aug. 5, 2024, 9:37 p.m...

CVE-2024-6422 Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access

An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data...

CVE-2024-27783

Fortinet FortiAIOps 2.0.0 is affected by a CSRF vulnerability in its web UI, allowing an unauthenticated attacker to trick a victim into making HTTP GET requests that perform arbitrary actions on behalf of a logged-in user. Root cause: insufficient validation of requests from trusted users in the...

CVE-2024-27783

Multiple cross-site request forgery CSRF weaknesses CWE-352 vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests...

CVE-2024-39876

CVE-2024-39876 affects Siemens SINEMA Remote Connect Server: all versions before 3.2 SP1 fail to properly handle log rotation, enabling a DoS via resource exhaustion. Public documents consistently cite the vulnerability as impacting the server and describe the root cause as log-rotation handling ...

CVE-2024-6427

MESbook is affected by CVE-2024-6427 via the message parameter in version 20221021.03, allowing an unauthenticated remote attacker to inject JavaScript payloads that cause the application to loop requests, leading to resource consumption and potential service disruption. Multiple connected source...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

CVE-2024-36072

The CVE-2024-36072 entry covers Netwrix CoSoSys Endpoint Protector (versions up to and including 5.9.3) and CoSoSys Unify (up to and including 7.0.6). A remote code execution flaw is located in the logging component of the Endpoint Protector/Unify server, allowing an unauthenticated attacker to s...