CVE-2024-8457 PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack...

CVE-2024-8457 PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack...

CVE-2024-45042 Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials

Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 1.3.0, given a number of preconditions, the highestavailable setting will incorrectly assume that the identity’s highest available AAL is aal1 even though it really is aal2. This means that t...

The vulnerability of the Siemens User Management Component (UMC) in products such as SIMATIC Information Server, SIMATIC PCS neo, SINEC NMS, and Totally Integrated Automation Portal (TIA Portal) allows a perpetrator to execute arbitrary code.

The vulnerability of the Siemens User Management Component UMC in products such as SIMATIC Information Server, SIMATIC PCS neo, SINEC NMS, and Totally Integrated Automation Portal TIA Portal is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attack...

CVE-2024-31415

The CVE-2024-31415 issue affects Eaton Foreseer EPMS software. The root cause is insecurely stored encryption keys used to protect server configuration data, allowing an attacker with local access to potentially change or remove external server configurations. Public documents describe the vulner...

Siemens User Management Component (UMC) Heap Buffer Overflow Vulnerability

SIMATIC PCS neo is a distributed control system DCS. sinec NMS is the new generation of network management systems NMS for the digital enterprise. The system can be used to centrally monitor, manage, and configure networks.Totally Integrated Automation Portal TIA Portal is a PC software that...

Exploit for CVE-2024-6624

CVE-2024-6624 JSON API User = 3.9.3 - Unauthenticated Priv...

Siemens SIMATIC 安全漏洞

SIMATIC PCS neo is a distributed control system DCS. sinec NMS is the new generation of network management systems NMS for the digital enterprise. The system can be used to centrally monitor, manage, and configure networks.Totally Integrated Automation Portal TIA Portal is a PC software that...

PT-2024-6147 · Siemens · Sinec Nms +6

Name of the Vulnerable Software and Affected Versions: SIMATIC Information Server versions 2022 and 2024 SIMATIC PCS neo versions 4.0, 4.1 through 4.1 Update 2, and 5.0 SINEC NMS versions prior to the fixed version Totally Integrated Automation Portal TIA Portal versions 16, 17 through 17 Update ...

SAP CTC Service Verb Tampering User Management

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, or is a port of a plugin available in the Onapsis Bizploit Opensource ERP Penetration Testing framework -...

The vulnerability of the Portainer container management platform, related to improper user management, allows a hacker to determine whether a user’s name is valid or not.

The vulnerability of the Portainer container management platform is related to the difference in user authentication response time. Exploiting this vulnerability allows a remote attacker to determine whether a user’s name is valid or not...

Mattermost Cross-Site Request Forgery vulnerability

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

GHSA-HRF9-RM95-FPF3 Mattermost Cross-Site Request Forgery vulnerability

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

CVE-2024-40886

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

CVE-2024-40886 One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

CVE-2024-40886 One-click Client-Side Path Traversal Leading to CSRF in User Management admin page

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...

CVE-2024-40886

Mattermost Server vulnerable versions include 9.5.x <= 9.5.7, 9.8.x <= 9.8.2, 9.9.x <= 9.9.1, and 9.10.x

PT-2024-29129 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.8.x through 9.8.2 Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.9.x through 9.9.1 Mattermost versions 9.10.x through 9.10.0 Description: The issue is related to a failure to sanitize user inputs in the...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a path traversal vulnerability that stems from an inability to clean up front-end user input used for redirection, which can be exploited by an attacker to cause a cross-site...

CVE-2024-7266

Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17...