PT-2023-4729 · NetGear · Netgear R6400V2

Name of the Vulnerable Software and Affected Versions: NETGEAR R6400v2 versions prior to 1.0.4.118 Description: The issue is related to a Buffer Overflow in the httpd service of the NETGEAR R6400v2 Wi-Fi router's firmware, which can be exploited by remote unauthenticated attackers to execute...

GE iFIX 代码注入漏洞

GE iFIX is General Electric's GE platform for improving productivity and process control through industrial-grade SCADA and high-performance HMI. A code injection vulnerability exists in GE iFIX. An attacker could use this vulnerability to insert a malicious configuration file into the intended w...

Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting

...

PT-2023-7457 · Ge Digital · Ge Digital Proficy Ifix

Name of the Vulnerable Software and Affected Versions: GE Digital Proficy iFIX versions 6.1 through 6.5 GE Digital Proficy iFIX 2022 Description: The issue is related to incorrect code generation management in the GE Proficy HMI/SCADA iFIX software, which may allow an attacker to gain full contro...

Atlassian Jira 6.5.x < 6.5.0.2 Software Tempo Plugin Xml Denial Of Service

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by a issue in the TM Software Tempo Plugin which does not properly restrict the capabilities of 3rd party XML parsers, which allows remote...

CVE-2023-0354

The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...

CVE-2023-0351

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

Command injection

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

Authentication flaw

The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...

CVE-2023-0351 CVE-2023-0351

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

CVE-2023-0351 CVE-2023-0351

The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...

CVE-2023-0351

The CVE-2023-0351 issue affects Akuvox E11 (all versions) where the web server backend library allows command injection in the device’s phone-book contacts functionality, enabling an attacker to upload files with executable command instructions. Public sources cite a high-severity CVSSv3.1 base s...

CVE-2023-0354 CVE-2023-0354

The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...

CVE-2023-0354

The CVE-2023-0354 entry concerns Akuvox E11, a SIP video doorphone. Public docs confirm a vulnerability where the E11 web server can be accessed without authentication, enabling an attacker to view sensitive information and to create/download packet captures via known default URLs. Affected produ...

CVE-2023-0354 CVE-2023-0354

The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects

A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022. The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target...

CVE-2023-0888

An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device...

CVE-2023-0888

Summary of this CVE (CVE-2023-0888) : A vulnerability in the Wi‑Fi Battery embedded web server of the B. Braun Space Battery Pack SP with Wi‑Fi, affecting versions L90/U70 and L92/U92. It is an improper neutralization of directives in dynamically evaluated code (Eval Injection) that could allow a...

CVE-2023-0888 Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi

An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 can be used to gain administrative access to the WiFi communication module. An authenticated user, having access to both the medical device...

PT-2023-16203 · Akuvox · Akuvox E11

Name of the Vulnerable Software and Affected Versions: Akuvox E11 affected versions not specified Description: The issue concerns command injection in the device phone-book contacts functionality of the Akuvox E11 web server backend library. This could allow an attacker to upload files with...