Gradio 命令注入漏洞

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a command injection vulnerability that stems from the fact that injection via command can lead to information disclosure...

PT-2024-11577 · Ibm · Ibm Security Verify Directory

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Directory version 10.0.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2024-2741 Cross-Site Request Forgery in Planet IGS-4215-16T2S

Cross-Site Request Forgery CSRF vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web...

CVE-2024-2741

The CVE-2024-2741 entry describes a CSRF vulnerability in Planet IGS-4215-16T2S (firmware 1.305b210528). The issue: an attacker could trick authenticated users into performing actions in their session via the Switch web interface (e.g., adding or updating accounts). If exploitation or in-the-wild...

CVE-2024-2741 Cross-Site Request Forgery in Planet IGS-4215-16T2S

Cross-Site Request Forgery CSRF vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to trick some authenticated users into performing actions in their session, such as adding or updating accounts through the Switch web...

CVE-2024-2740

CVE-2024-2740 affects Planet IGS-4215-16T2S, firmware 1.305b210528, due to improper management of the Switch web interface that leads to information disclosure. Affected component: the web interface; root cause: lack of proper access control/handling for administrative resources. Impact: potentia...

CVE-2024-2740 Exposure of Sensitive Information to an Unauthorized Actor in Planet IGS-4215-16T2S

Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface...

CVE-2024-2740 Exposure of Sensitive Information to an Unauthorized Actor in Planet IGS-4215-16T2S

Information exposure vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. This vulnerability could allow a remote attacker to access some administrative resources due to lack of proper management of the Switch web interface...

PT-2024-21877 · Planet · Planet Igs-4215-16T2S

Name of the Vulnerable Software and Affected Versions: Planet IGS-4215-16T2S version 1.305b210528 Description: The issue is related to an information exposure vulnerability. It could allow a remote attacker to access some administrative resources due to the lack of proper management of the Switch...

CVE-2024-22082

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system...

CVE-2024-22082

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system...

The vulnerability of the microprogramming software of the GL.iNet GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, and GL-AR300M routers relates to the bypassing of authentication processes, allowing an intruder to gain unauthorized access to the router’s web interface.

The vulnerability of the microprogramming software of the GL.iNet GL-A1300, GL-AX1800, GL-AXT1800, GL-MT3000, GL-MT2500, GL-MT6000, GL-MT1300, GL-MT300N-V2, GL-AR750S, GL-AR750, GL-AR300M, and GL-B1300 lies in their ability to bypass authentication. Exploiting this vulnerability can allow an...

Elspec G5 digital fault recorder security vulnerability

The Elspec G5 digital fault recorder is a digital fault recorder from Elspec, Israel, used to monitor and record fault events and waveform data in power systems. A security vulnerability exists in Elspec G5 digital fault recorder version 1.1.4.15 and prior versions, which is caused by the presenc...

CVE-2024-22082

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated directory listing can occur: the web interface cay be abused be an attacker get a better understanding of the operating system...

Unspecified Vulnerability in Palo Alto Networks PAN-OS (CNVD-2024-20507)

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks PAN-OS. An attacker could exploit the vulnerability to store a JavaScript payload using the web interface on the Panorama device...

PT-2024-19193 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered that allows unauthenticated directory listing to occur. The web interface can be abused by an attacker to gain a better understanding of the...

CVE-2024-28237

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

PYSEC-2024-179

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...

CVE-2024-28237

The CVE-2024-28237 issue affects OctoPrint prior to 1.10.0rc3, specifically the Classic Webcam plugin snapshot URL feature. The root cause is a cross-site scripting (XSS) vulnerability where a crafted webcam snapshot URL tested via the web interface can cause JavaScript to execute in a victim adm...

CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through th...