LoLLMs Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a command injection vulnerability that stems from insufficient cleanup of user input, leading to arbitrary code execution...

CVE-2024-20383

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...

CVE-2024-20258

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient...

CVE-2024-20256

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient...

CVE-2024-20257

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.r This vulnerability is due to insufficient validation of user input. An attacker...

CVE-2024-4622

If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator...

CVE-2024-4622 alpitronic Hypercharger EV Charger Use of Default Credentials

If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator...

CVE-2024-4622

CVE-2024-4622 affects alpitronic Hypercharger EV charging devices. When credentials are left at defaults, an attacker can gain administrator access to the device via the web interface. The vulnerability is network-exposed with low attack complexity and can impact availability (HIGH) and confident...

CVE-2023-5935

When configuring Arc e.g. during the first setup, a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. A malicious local user or process, during a window of...

CVE-2023-5935

CVE-2023-5935 affects Arc prior to v1.6.0. During initial/configuration time, Arc exposes a local web interface without authentication. A local attacker or malware active at that window can extract sensitive information or alter Arc’s configuration, and may achieve arbitrary code execution via a ...

Missing authentication for local web interface in Arc before v1.6.0

Summary When configuring Arc e.g. during the first setup, a local web interface is provided to ease the configuration process. Such web interface lacks authentication and may thus be abused by a local attacker or malware running on the machine itself. Impact A malicious local user or process,...

PT-2024-4561 · Cisco · Cisco Asyncos

Name of the Vulnerable Software and Affected Versions: Cisco AsyncOS Software for Cisco Secure Email Gateway affected versions not specified Description: The issue is related to insufficient validation of user input in the web-based management interface, allowing an authenticated, remote attacker...

The vulnerability of the /cgi-bin/upload_config.cgi file in the web interface of the Peplink Smart Reader time tracking and bandwidth management system allows a perpetrator to alter the configuration settings.

The vulnerability of the /cgi-bin/uploadconfig.cgi file of the Peplink Smart Reader web interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to modify configurations by sending a specially crafted HTTP request...

Yealink Device Management Platform Web Interface Detection

Binary data yealinkdevicemanagementplatformwebdetect.nbin...

PT-2024-31925 · Alpitronic · Alpitronic Hypercharger Ev Charging Devices

Name of the Vulnerable Software and Affected Versions: alpitronic Hypercharger EV charging devices affected versions not specified Description: The issue concerns alpitronic Hypercharger EV charging devices that can expose a web interface protected by authentication if misconfigured. If the defau...

PT-2024-14844 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The local web interface provided during the configuration of Arc lacks authentication, making it vulnerable to abuse by local attackers or malware. This could allow a malicious local user or...

CVE-2024-32977

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-31485

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...

CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-31485

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...