4081 matches found
CVE-2024-8882
A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80AAHN.1C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service DoS conditions via a crafted URL...
PT-2024-30573 · Unknown · Decidim Awesome-Module
Name of the Vulnerable Software and Affected Versions: decidim awesome-module versions 0.9.0 through 0.11.1 Description: An improper neutralization of special elements used in an SQL command in the papertrail/version-model of the decidim awesome-module allows an authenticated admin user to...
PT-2024-8703 · Ivanti · Ivanti Policy Secure +1
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to command injection, allowing a remote authenticated attacker with admin privileges to achieve remote code...
D-Link DSL6740C 操作系统命令注入漏洞
The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from an operating system command injection vulnerability, which can be exploited by a remote attacker with administrator privileges to inject and execute arbitrary system commands via specific...
PT-2024-8721 · Ivanti · Ivanti Policy Secure +1
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to incorrect input handling in Ivanti Connect Secure and Ivanti Policy Secure, allowing a remote attacker to...
CVE-2024-52009
Atlantis (a self-hosted Golang app that handles Terraform PR webhooks) exposes GitHub credentials in its logs when rotated. The root cause is that credentials (tokens like gh s_…) were written to logs, enabling someone with log access to impersonate Atlantis and perform GitHub actions, potentiall...
SQL Injection
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to SQL Injection through the XMLDB editor tool. An attacker with administrative privileges can manipulate database queries and potentially access or modify data without proper authorization by injectin...
Cross-Site Scripting (XSS)
Umbraco is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization in the Dictionary section, which can allow attackers to inject and execute malicious scripts when accessed by a user with admin privileges...
PT-2024-12197 · Enel X · Waybox Enel X
Name of the Vulnerable Software and Affected Versions: Waybox Enel X affected versions not specified Description: The Waybox Enel X web management API authentication could be bypassed, providing administrator’s privileges over the Waybox system. This issue affects specific versions of Waybox, but...
The vulnerability in the web interface for managing microprogrammed software devices of Cisco Analog Telephone Adapter (ATA) series 190 allows a perpetrator to execute commands on behalf of the Admin user.
The vulnerability of the web interface for managing microprogrammed software in Cisco Analog Telephone Adapter ATA devices of the 190 series is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute commands on behalf of the Admin user by sending a...
PT-2024-32336 · Sharp +1 · Sharp Mfps +1
Name of the Vulnerable Software and Affected Versions: Sharp and Toshiba Tec MFPs affected versions not specified Description: The issue concerns configuration-related APIs in Sharp and Toshiba Tec MFPs that are insufficiently restricted, allowing non-administrative users to execute some...
PT-2024-7476 · Cisco · Cisco Secure Firewall Management Center (Fmc)
Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Management Center FMC Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remo...
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Patches Will be patched in 14.3.1 and 15.0.0. Workarounds...
GHSA-C5G6-6XF7-QXP3 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Impact This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can potentially elevate all users and grant them admin privileges or access protected content. Patches Will be patched in 14.3.1 and 15.0.0. Workarounds...
CVE-2024-47819
CVE-2024-47819 – Umbraco XSS (Dictionary section) Affected: Umbraco CMS (.NET) versions 14.0.0 up to, but not including, 14.3.1 and 15.0.0.Root cause: cross-site scripting vulnerability in the Dictionary section that can be triggered by an admin-privileged user to execute injected scripts.Impact:...
CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prior to versions 14.3.1 and 15.0.0. This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the...
Kieback&Peter DDC4000 安全漏洞
The Kieback&Peter DDC4000 is a building automation and control system from Kieback&Peter, a German company, that is used to manage and monitor various devices in a building. A security vulnerability exists in the Kieback&Peter DDC4000 that stems from the use of weak credentials that could allow a...
Vilo Mesh WiFi System 访问控制错误漏洞
Vilo Mesh WiFi System is a wireless system from Vilo. A security vulnerability exists in Vilo Mesh WiFi System version 5.16.1.33 and earlier, which stems from a lack of authentication of a custom TCP service, which makes it vulnerable to attacks with insecure privileges and allows a remote,...
CVE-2024-9858
CVE-2024-9858 affects Google Cloud Migrate to Containers for Windows (versions 1.1.0–1.2.2). The root cause is an insecure default local user, m2cuser, created with administrator privileges. If the analyze or generate workflow is interrupted or the local user is not deleted, this user could be ex...
