PT-2024-38965 · WordPress · Uncanny Groups For Learndash

Name of the Vulnerable Software and Affected Versions: Uncanny Groups for LearnDash plugin for WordPress versions up to, and including, 6.1.0.1 Description: The issue allows authenticated attackers with group leader-level access and above to exploit a missing capability check on the "/wp-json/ulg...

CVE-2024-8887

CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service DoS attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow...

CVE-2024-8887 Authentication bypass vulnerability on CIRCUTOR Q-SMT

CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service DoS attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow...

CVE-2024-8887 Authentication bypass vulnerability on CIRCUTOR Q-SMT

CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service DoS attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow...

Bravura Security Fabric 安全漏洞

Bravura Security Fabric is a suite of identity and access management software from Bravura Security. A security vulnerability exists in Bravura Security Fabric that stems from an unauthenticated attacker being able to cause a resource disclosure by making multiple failed login attempts via API...

PT-2024-39299 · Circutor · Circutor Q-Smt

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: The issue allows an attacker with access to the web service to bypass authentication mechanisms on the login page, enabling them to use all functionalities implemented at the web level that allow...

PT-2024-39271 · Cohesive Networks · Cohesive Networks Vns3

Name of the Vulnerable Software and Affected Versions: Cohesive Networks VNS3 affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Cohesive Networks VNS3. Authentication is not required to exploit this issue. The...

Trend Micro Deep Discovery Inspector SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Deep Discovery Inspector. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 443 by default. The...

PT-2024-39273 · Cohesive Networks · Cohesive Networks Vns3

Name of the Vulnerable Software and Affected Versions: Cohesive Networks VNS3 affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Cohesive Networks VNS3. Authentication is required to exploit this issue. The specif...

PT-2024-39270 · Cohesive Networks · Cohesive Networks Vns3

Name of the Vulnerable Software and Affected Versions: Cohesive Networks VNS3 affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Cohesive Networks VNS3. Authentication is not required to exploit this issue. The...

Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cohesive Networks VNS3. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8000 by default. The issue results from th...

CVE-2024-45694

The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device...

CVE-2024-45694

The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device...

CVE-2024-45695

The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device...

CVE-2024-45696

CVE-2024-45696 affects certain D‑Link wireless routers. According to the sources, a hidden functionality can be triggered by sending crafted packets to the device’s web service, forcibly enabling the telnet service and allowing login with hard‑coded credentials. The telnet access is restricted to...

CVE-2024-45695

CVE-2024-45695 affects D-Link DIR-X4860 wireless routers. The web service exposes a stack-based buffer overflow in unauthenticated context, enabling remote code execution. Public sources confirm the DIR-X4860 as affected and describe the root cause as a stack-based overflow in the device’s web se...

The vulnerability of the software for working with reports and data in the web environment of SAP Business Explorer’s BEx Web Java Runtime Export Web Service lies in errors in the processing of XML requests. This vulnerability allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the software for working with reports and data in the web environment of SAP Business Explorer’s BEx Web Java Runtime Export Web Service is related to errors in processing XML requests. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and...

PT-2024-31434 · Lenovo · Lxca

Name of the Vulnerable Software and Affected Versions: LXCA affected versions not specified Description: A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call...

PT-2024-6868 · D Link · D-Link Covr-X1870 +2

Name of the Vulnerable Software and Affected Versions: D-Link wireless routers affected versions not specified D-Link DIR-X4860 D-Link DIR-X5460A1 D-Link COVR-X1870 Description: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, whic...

CVE-2024-37397

An External XML Entity XXE vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets...