CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2...

PT-2025-13591 · Onenav · Onenav

Name of the Vulnerable Software and Affected Versions: OneNav version 1.1.0 Description: The issue is related to Server-Side Request Forgery SSRF in custom headers. This means an attacker could potentially force the server to make requests to arbitrary domains, which could lead to unauthorized...

OpenVPN Access Server Detected

This is an informational notice that the scanner was able to detect an OpenVPN Access Server on the target server. Note that this detection is included in the Remote Access Tools category. No source data...

CVE-2024-37903

Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

Magma 安全漏洞

Magma is an open source software platform from Magma Open Source. Provides network operators with an open, flexible and scalable mobile core network solution. Magma has a buffer overflow vulnerability that can be exploited by an attacker to trigger a denial of service DoS via a carefully crafted...

Magma 安全漏洞

Magma is an open source software platform from Magma Open Source. Provides network operators with an open, flexible and scalable mobile core network solution. Magma has a buffer overflow vulnerability that can be exploited by an attacker to cause a denial of service DoS via a carefully crafted NA...

Magma 安全漏洞

Magma is an open source software platform from Magma Open Source. Provides network operators with an open, flexible and scalable mobile core network solution. Magma has a security vulnerability that can be exploited by an attacker to cause a denial of service DoS via a carefully crafted NAS packe...

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response t...

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client...

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in get view method under view parameter. The ETIC RAS web server uses dynamic pages that get their input from the client side and reflect the input in their response t...

CVE-2024-26154

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages...

CVE-2024-26154

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages...

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting XSS attacks in the method parameter. The ETIC RAS web server uses dynamic pages that gets their input from the client side and reflects the input in its response to the client...

CVE-2024-26155

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 expose clear text credentials in the web portal. An attacker can access the ETIC RAS web portal and view the HTML code, which is configured to be hidden, thus allowing a connection to the ETIC RAS ssh server, which could enable ...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153 ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153 ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery

All versions of ETIC Telecom Remote Access Server RAS prior to 4.9.19 are vulnerable to cross-site request forgery CSRF. An external attacker with no access to the device can force the end user into submitting a "setconf" method request, not requiring any CSRF token, which can lead into denial of...

CVE-2024-26153

CVE-2024-26153 affects ETIC Telecom Remote Access Server (RAS) versions prior to 4.9.19. The issue is a CSRF flaw in the web portal that allows an external attacker with no device access to coerce an end user into submitting a setconf request without a CSRF token, potentially causing device denia...