22150 matches found
PT-2023-22477 · Smm V1 +2 · Smm V1 +2
Name of the Vulnerable Software and Affected Versions: SMM v1 affected versions not specified SMM v2 affected versions not specified FPC affected versions not specified Description: An unauthenticated denial of service issue exists in the management web server of the affected products, which can ...
The vulnerability of the Spectrum Power software-based web server allows attackers to carry out cross-site scripting attacks.
The vulnerability of the Spectrum Power software web server relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created malicious link...
CVE-2023-2992: Asymmetric Resource Consumption (Amplification)
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server...
MagnusBilling application unauthenticated Remote Command Execution.
A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. A piece of demonstration code is present in lib/icepay/icepay.php, with a call to an exec. The parameter to exec includes the GET paramete...
PT-2023-24726 · Mongoose · Mongoose
Name of the Vulnerable Software and Affected Versions: Mongoose versions prior to 7.10 Description: The issue arises from the HTTP server in Mongoose accepting requests with negative Content-Length headers. This can be exploited by an attacker sending a single malicious payload over TCP, causing...
CVE-2023-29709
An issue was discovered in /cgi-bin/loginrj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass authentication...
The vulnerability of the httpd function’s unescape function in the cgi.c file of the Asuswrt-Merlin New Gen microprogramming system allows a hacker to cause memory corruption.
The vulnerability of the unescape function in httpd’s cgi.c file of the Asuswrt-Merlin New Gen software relates to the escape operation going beyond buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause memory corruption by sending a specially crafted...
HiSecOS 04.0.01 - Privilege Escalation
Exploit Title: HiSecOS 04.0.01 - Privilege Escalation Google Dork: HiSecOS Web Server Vulnerability Allows User Role Privilege Escalation Date: 21.06.2023 Exploit Author: dreizehnutters Vendor Homepage:...
Jenkins LTS < 2.401.1 / Jenkins weekly < 2.400 XSRF
According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.401.1 or Jenkins weekly prior to 2.400. It is, therefore, affected by the following vulnerability: - In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST...
CVE-2023-25367
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
CVE-2023-25367
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
Design/Logic Flaw
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
CVE-2023-25367
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
CVE-2023-25367
CVE-2023-25367 affects Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS. The issue is unfiltered user input allowing Remote Code Execution via the SCPI interface or web server. Root cause: insufficient input validation and, in some sources, lack of authentication on the SCPI interface, enabling remot...
CVE-2023-25367
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
CVE-2023-25367: Undefined Security Weakness
Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...
golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption
A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service...
PT-2023-3379 · Siemens · Cp-8050 Master Module +1
Name of the Vulnerable Software and Affected Versions: CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05 Description: A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker...
CVE-2023-1897
Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller...