Avtec Outpost 0810

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Avtec Equipment : Outpost 0810, Outpost Uploader Utility Vulnerability : Storage of File with Sensitive Data Under Web Root, Use of Hard-coded Cryptographic Key 2. RISK EVALUATION Successful...

CVE-2024-36439

Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash value, without knowing the actual device password...

CVE-2024-36439

Swissphone DiCal-RED 4009 devices are affected by CVE-2024-36439, where a remote attacker can access the administrative web interface using the device password’s hash value without knowing the actual password. The vulnerability arises in the authentication flow and, per the gathered sources, ther...

CVE-2024-20466

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

CVE-2024-20466 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value...

CVE-2024-20486 Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

CVE-2024-20488

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

Gitlab -- vulnerabilities

Gitlab reports: The GitLab Web Interface Does Not Guarantee Information Integrity When Downloading Source Code from Releases Denial of Service by importing maliciously crafted GitHub repository Prompt injection in "Resolve Vulnerabilty" results in arbitrary command execution in victim's pipeline ...

Ewon Cosy+ Improper Neutralization / Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-016 Product: Ewon Cosy+ Manufacturer: HMS Industrial Networks AB Affected Versions: Firmware Versions: 21.2s10 and 22.1s3 Tested Versions: Firmware Version: 21.2s7 Vulnerability Type: Improper Neutralization of Input During We...

The vulnerability of the web interface of the microprogramming software for Cisco Small Business SPA300 and SPA500 allows a perpetrator to execute arbitrary commands in the basic operating system.

The vulnerability of the web interface of Cisco Small Business SPA300 and SPA500 microprogramming software lies in the copying of input data into memory without checking its size. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands on the basic...

The vulnerability in the web interface for managing microprogrammed IP phones from Cisco Small Business SPA300 and SPA500 allows a hacker to trigger a service failure.

The vulnerability in the web interface for managing Microprogramming software in Cisco Small Business SPA300 and SPA500 phones is related to the copying of input data into the buffer without checking its size. Exploiting this vulnerability can allow an attacker, operating remotely, to cause servi...

The vulnerability in the web interface for managing microprogrammed IP phones from Cisco Small Business SPA300 and SPA500 allows a hacker to trigger a service failure.

The vulnerability in the web interface for managing Microprogramming software in Cisco Small Business SPA300 and SPA500 phones is related to the copying of input data into the buffer without checking its size. Exploiting this vulnerability can allow an attacker, operating remotely, to cause servi...

CVE-2024-41774

IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 3503...

CVE-2024-2259 Reflected XXS Vulnerability in InstaRISPACS Software

This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerabl...

PT-2024-19494 · Unknown · Instarispacs

Name of the Vulnerable Software and Affected Versions: InstaRISPACS affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input for the loginTo parameter in the user login module of the web interface. A remote attacker could exploit this by...

Ivanti Virtual Traffic Manager (vTM) Web Interface Detection

Binary data ivantivirtualtrafficmanagerwebdetect.nbin...

DEBIAN-CVE-2024-22122

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem...

The vulnerability in the web interface of a Git-based software platform for collaborative code development on GitLab allows a perpetrator to influence the integrity of the protected information.

The vulnerability of the Git-based software platform’s web interface for collaborative code development on GitLab is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected...

The vulnerability in the web interface of the LoLLMS WebUI system, which is used for launching and managing large language models in LoLLMS (Lord of Large Language Multimodal Systems), involves an uncontrolled resource consumption. This allows a malicious user to cause a service failure.

The vulnerability in the LoLLMS WebUI web interface, which is used to launch and manage large language models in LoLLMS Lord of Large Language Multimodal Systems, involves an uncontrolled resource consumption during the processing of the end-point opencodeinvscode. Exploiting this vulnerability...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to improper code generation management, allows a hacker to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to incorrect representation of the web application and command-line interface due to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute...