CVE-2024-3497 Directory Traversal Remote Code Execution Vulnerability

Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL...

CVE-2024-3497

The CVE-2024-3497 entry refers to a directory traversal vulnerability in the web server of Toshiba e-STUDIO printers. The issue allows a network-adjacent attacker to overwrite or add files via path traversal in the unzip operation, with ZDI noting possible remote code execution and no authenticat...

CVE-2024-3497 Directory Traversal Remote Code Execution Vulnerability

Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL...

PT-2024-27013 · Ca Technologies · Siteminder Web Agent For Domino Web Server +1

Name of the Vulnerable Software and Affected Versions: SiteMinder Web Agent for IIS Web Server affected versions not specified SiteMinder Web Agent for Domino Web Server affected versions not specified Description: A CRLF cross-site scripting issue has been identified in certain configurations of...

Broadcom Symantec SiteMinder Security Vulnerability

Broadcom Symantec SiteMinder is an identity provider and federation system from Broadcom, Inc. Provides access to web applications and portals. A security vulnerability exists in Broadcom Symantec SiteMinder Web Agent for IIS Web Server and SiteMinder Web Agent for Domino Web Server, which stems...

Siemens SINEC Traffic Analyzer Credential Protection Insufficiency Vulnerability

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communication between controllers and IO devices. The software detects PROFINET communication problems and reports them to the user via Web-UI. Siemens SINEC Traffic Analyzer suffers from a Credential Protection...

CVE-2024-37295 Aimeos Core remote code execution in web server context

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...

CVE-2024-37295 Aimeos Core remote code execution in web server context

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...

USN-6826-1 libapache-mod-jk vulnerability

Karl von Randow discovered that modjk was vulnerable to an authentication bypass. If the configuration did not provide explicit mounts for all possible proxied requests, an attacker could possibly use this vulnerability to bypass security constraints configured in httpd...

CVE-2024-35211

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...

CVE-2024-35209

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files...

CVE-2024-35211

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...

CVE-2024-35208

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords...

CVE-2024-35208

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords...

CVE-2024-35211

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes such as “Secure”, “HttpOnly”, or “SameSite”...

CVE-2024-35211

The CVE-2024-35211 issue affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0), all versions prior to V1.2. The underlying flaw is that the web server sets session cookies after login without security attributes (no Secure, HttpOnly, or SameSite), exposing potentially sensitive session data...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

CVE-2024-35210

The CVE-2024-35210 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) versions prior to V1.2. Root cause: the web server does not enforce HTTPS HSTS, enabling downgrade attacks that could expose confidential information. Impact is described as high (CVSS v3.1 base score 7.5; confidential...

CVE-2024-35209

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is allowing HTTP methods like PUT and Delete. This could allow an attacker to modify unauthorized files...