PT-2025-2796

Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wi-Fi 5 BR-6476AC version 1.06 Description The issue is related to the lack of protection for the web interface structure of the Edimax AC1200 Wi-Fi 5 BR-6476AC router's firmware, allowing a remote attacker to conduct a Cross Sit...

The vulnerability of the web interface of the IBM InfoSphere Information Server software platform allows a perpetrator to disclose account information during a secure session.

The vulnerability in the web interface of the IBM InfoSphere Information Server software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to disclose credentials during a secure sessio...

The vulnerability of the web interface of the IBM InfoSphere Information Server software platform allows a perpetrator to disclose account information during a secure session.

The vulnerability in the web interface of the IBM InfoSphere Information Server software integration platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability can allow a malicious actor to disclose credentials during a secure sessio...

The vulnerability of the web interface of IP-telephone devices, BAS-IP, allows a perpetrator to disclose protected information.

The vulnerability of the web interface of IP-telephone devices BAS-IP relates to the storage of user credentials in configuration files. Exploiting this vulnerability can allow an attacker to disclose sensitive information by sending a specially crafted HTTP request...

The vulnerability of the Diagnosis Ping function in the administrative web interface of the Ethernet switch microprogramming software from Moxa, models Moxa EDS-405A and Moxa EDS-408A, allows a hacker to execute arbitrary code.

The vulnerability of the Diagnosis Ping function in the administrative web interface of Microprogrammed Ethernet switches of the Moxa EDS-405A and Moxa EDS-408A series is related to insufficient protection of the web page structure. Exploiting this vulnerability allows a remote attacker to execut...

The vulnerability in the web interface of Netgear DG834Gv5 integrated software for routers allows a hacker to disclose protected information.

The vulnerability in the web-based management interface of Netgear DG834Gv5 integrated software lies in the unencrypted storage of critical information. Exploiting this vulnerability allows an attacker to disclose the protected data remotely...

The vulnerability of the web interface of the monitoring and analysis software for network traffic in industrial networks, SINEC Traffic Analyzer, allows a hacker to perform a CSRF attack.

The vulnerability of the web interface of the monitoring and network traffic analysis software in industrial networks, SINEC Traffic Analyzer, is related to the falsification of cross-site requests. Exploiting this vulnerability allows a perpetrator to carry out a CSRF attack using a specially...

The vulnerability in the web interface of microprogramming software for devices for remote control of lighting and energy consumption from Schneider Electric Sage allows a perpetrator to compromise the integrity of protected information and cause service interruptions.

The vulnerability of the web interface of microprogramming software for devices for remote control of lighting and energy consumption in Schneider Electric Sage is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a...

Vulnerability of the web interface for operating system management software FortiOS and the proxy server FortiProxy, which allows for the execution of arbitrary code.

The vulnerability in the web management interface of FortiOS operating systems and the FortiProxy proxy server for protecting against Internet attacks is related to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2024-5951

Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this...

CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...

PT-2024-36031 · Iap-420 · Iap-420

Name of the Vulnerable Software and Affected Versions: IAP-420 versions 2.01e and below Description: The issue is related to missing input validation in the ORing IAP-420 web-interface, which allows stored Cross-Site Scripting XSS. This problem is being actively exploited. Recommendations: For...

The vulnerability in the web interface of Cisco Firepower Management Center’s software for network management allows a perpetrator to execute arbitrary code.

The vulnerability of the web interface for managing Cisco Firepower Management Center FMC software involves a lack of measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code by injecting a specially crafted SQL query remotely...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 allows a perpetrator to disclose protected information.

The vulnerability of the web-based management interface for Cisco IP Phones 6800, 7800, 8800, and Cisco Video Phone 8875 is related to the ability to bypass authentication due to a software bug. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

LoLLMs Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a command injection vulnerability that stems from insufficient cleanup of user input, leading to arbitrary code execution...

Digital Prototype Systems NetGuardian DIN 安全漏洞

Digital Prototype Systems NetGuardian DIN is a small industrial RTU from Digital Prototype Systems. A security vulnerability exists in the Digital Prototype Systems NetGuardian DIN that stems from multiple vulnerabilities in the web interface...

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software allows a attacker to perform XSS attacks.

The vulnerability of the setWiFiExtenderConfig function in TOTOLINK EX200 router microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of the web interface of Tp-Link AC1350 wireless access points allows a hacker to trigger a service failure.

The vulnerability of the web interface of Tp-Link AC1350 wireless access points is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially crafted HTTP POST request...

DirectCyber Evolution Controller 安全漏洞

DirectCyber Evolution Controller is an access control controller software from DirectCyber, Inc. that is used to controller physical access to facilities. A security vulnerability exists in DirectCyber Evolution Controller version 2.04.560.31.03.2024 and prior versions, which stems from an...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A path traversal vulnerability exists in LoLLMs lollms-webui that stems from insufficient validation of user-supplied file paths...