VulnCheck KEV: CVE-2024-5910

Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data...

Palo Alto Networks Expedition Missing Authentication Vulnerability

Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data...

JATOS 安全漏洞

JATOS is an online learning tool from JATOS Open Source. A security vulnerability exists in JATOS version v3.9.3. An attacker exploiting this vulnerability could perform administrator-only operations, including creating an administrator account...

PT-2024-34148 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1 Description: The issue arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application, allowing an attacker to inject...

CVE-2024-51381: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin accounts. This critical flaw can lead to unauthorized activities, compromising the security and integrity of the platform, especially if an...

PT-2024-8367 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a command injection vulnerability in the sysNewPasswd parameter at the "admin account.cgi" endpoint. This vulnerability allows attackers to execute arbitrary OS commands via...

CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

CVE-2024-51382: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes

This report is not public...

Admin account takeover due to allowed excessive guessing attempts for password reset code

This report is not public...

Admin user account takeover due to password reset code not being checked on the backend

This report is not public...

CVE-2024-49397

The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts...

CVE-2024-49397

Elvaco M-Bus Metering Gateway CMe3100 (version 1.12.1) is affected by CVE-2024-49397, a cross-site scripting (CWE-79) vulnerability in the web interface that can bypass authentication and potentially takeover the administrator account. The issue is documented in multiple sources (e.g., Red Hat, C...

PT-2024-33507

Name of the Vulnerable Software and Affected Versions Product affected versions not specified Description The issue is related to a cross-site scripting attack, which may allow an attacker to bypass authentication and take over admin accounts. This could potentially lead to unauthorized access an...

CVE-2024-49397: Improper Neutralization of Input During Web Page Generation

The affected product is vulnerable to a cross-site scripting attack which may allow an attacker to bypass authentication and takeover admin accounts...

CVE-2024-9467 Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure

A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedition browser session theft...

CVE-2024-9466 Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials...

CVE-2024-9465 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

CVE-2024-9464 Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls...