CVE-2023-41681

A improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.1, FortiSandbox 4.2.1 through 4.2.5, FortiSandbox 4.0.0 through 4.0.3, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all...

CVE-2023-41836

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox 4.2.1 through 4.2.4, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.4 through 3.0.7 allow...

PT-2023-6010 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 2.4.0 through 2.5.2 FortiSandbox versions 3.2.0 through 3.2.4 FortiSandbox versions 4.0.0 through 4.0.3 FortiSandbox versions 4.2.0 through 4.2.5 FortiSandbox version 4.4.0 Description: The issue is related to an imprope...

Peplink Surf SOHO HW1 Operating System Command Injection Vulnerability

The Peplink Surf SOHO HW1 is a small router from Peplink. An OS command injection vulnerability exists in Peplink Surf SOHO HW1 v6.3.5, which stems from an OS command injection vulnerability in the data.cgi xferdns function. An attacker can exploit this vulnerability to execute commands via...

Fortinet FortiMail Security Vulnerability

Fortinet FortiMail is a set of e-mail security gateway products of the U.S. Fita Fortinet. The product provides email security and data protection features. A security vulnerability exists in Fortinet FortiMail that stems from an incorrect authorization vulnerability that allows an authenticated...

The vulnerability of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) lies in their insufficiently checked incoming requests, allowing a perpetrator to trigger a service failure.

The vulnerabilities of the Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, and Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P are related to insufficient checking of incoming requests duri...

Fortinet FortiWLM Operating System Command Injection Vulnerability

Fortinet FortiWLM is a wireless manager from Fortinet. A security vulnerability exists in Fortinet FortiWLM that stems from the presence of an operating system command injection vulnerability. The vulnerability allows an attacker to execute unauthorized code or commands via specially crafted http...

The vulnerability of the SetSysEmailSettings() function in D-Link DIR-3040 wireless router software allows a hacker to execute arbitrary code.

The vulnerability of the SetSysEmailSettings function in D-Link DIR-3040 wireless router software lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HNAP requests ...

The vulnerability of the SetWLanRadioSecurity() function in D-Link DIR-3040 wireless router software allows a hacker to execute arbitrary code.

The vulnerability of the SetWLanRadioSecurity function in D-Link DIR-3040 wireless router software lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HNAP requests...

CVE-2023-5101

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...

CVE-2023-43697

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

CVE-2023-5102

Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests...

Splunk 9.0.5 - admin account take over

!/usr/bin/env python3 Exploit Title: Splunk 9.0.5 - admin account take over Author: Redway Security Discovery: Santiago Lopez CVE: CVE-2023-32707 Vendor Description: A low-privilege user who holds a role that has the edituser capability assigned to it can escalate their privileges to that of the...

CVE-2023-44860

An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request...

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage) centralized network management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager formerly Cisco SD-WAN vManage centralized network management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protecte...

The vulnerability lies in the cropImage function of the software tool for creating and distributing content with LG Simple Editor. This function allows a malicious user to delete any files they desire.

The vulnerability of the cropImage function in the software for creating and distributing content with LG Simple Editor arises due to a typing error during the processing of command-line arguments that handle directory traversal. Exploiting this vulnerability allows an attacker to send specially...

CVE-2023-43323

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...

The vulnerability of the Qlik Sense Enterprise data analysis platform, related to insufficient validation of input data, allows a perpetrator to send arbitrary HTTP requests.

The vulnerability of the Qlik Sense Enterprise data analysis platform is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to send arbitrary HTTP requests remotely...

CVE-2022-47559

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

CVE-2022-47559

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...