Exploit for CVE-2024-4956

CVE-2024-4956 CVE-2024-4956 is a serious path traversal vulne...

CVE-2024-28141

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141

The Image Access Scan2Net scanning software is vulnerable to a Cross-Site Request Forgery (CSRF) attack because its web application lacks proper protection against such requests. An attacker could trick a user into visiting a malicious link or an attacker-controlled website, leading to unauthoriz...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

Image Access Scan2Net security vulnerability

Image Access Scan2Net is a scanning software from Image Access Germany. A security vulnerability exists in Image Access Scan2Net that originates from a web application that is not protected against cross-site request forgery attacks...

What You Should Know About BreakingWAF

BreakingWAF is not a vulnerability stemming from WAF solutions — it is a misconfiguration vulnerability that can be addressed during customer onboarding...

Drupal XSS Vulnerability (SA-CORE-2024-003) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

PT-2025-26186

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.11.11 Description An unauthenticated malicious actor can execute arbitrary code by using the '/locales/locale.json' endpoint with the locale and namespace query parameters. This flaw allows for complete server...

SAP Adobe Document Service code-related vulnerabilities

Adobe Document Service is a service provided by Adobe for processing documents, supporting PDF creation, editing and other functions. A code issue exists in Adobe Document Service that originates from a vulnerability that allows an attacker with administrator privileges to send a specially crafte...

CVE-2024-50625

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when...

Fixed in Apache Tomcat 9.0.98

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 9.0.98 or later, users running Tomcat on a case insensitive file system with the...

Fixed in Apache Tomcat 11.0.2

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - CVE-2024-56337 The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the...

CVE-2024-50625

Digi ConnectPort LTS versions prior to 1.4.12 are vulnerable to a file path manipulation flaw in the web application's file upload handling. Attackers can use POST requests to specific API endpoints, such as /file/upload, to manipulate the file path variable. This allows for arbitrary file upload...

CVE-2024-48703

PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting XSS in /admin/search-medicalcard.php via the searchdata parameter...

CVE-2024-10774

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774

Affected products: SICK InspectorP61x and InspectorP62x (industrial 2D vision sensors). Root cause: unauthenticated CROWN APIs that expose critical functionality. Impact: enables access to large parts of the web application without authentication (potential confidentiality, integrity, and availab...

CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

PT-2024-16534

Name of the Vulnerable Software and Affected Versions CROWN affected versions not specified Description The issue allows unauthenticated access to critical functions through CROWN APIs, making large parts of the web application accessible without authentication. Recommendations At the moment, the...