1785 matches found
CVE-2024-28141
The Image Access Scan2Net scanning software is vulnerable to a Cross-Site Request Forgery (CSRF) attack because its web application lacks proper protection against such requests. An attacker could trick a user into visiting a malicious link or an attacker-controlled website, leading to unauthoriz...
CVE-2024-50625
Digi ConnectPort LTS versions prior to 1.4.12 are vulnerable to a file path manipulation flaw in the web application's file upload handling. Attackers can use POST requests to specific API endpoints, such as /file/upload, to manipulate the file path variable. This allows for arbitrary file upload...
Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor
The China-aligned advanced persistent threat APT actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia. That's according to findings from cybersecurity firm ESET based on multiple Linux samples...
CVE-2024-42389 Use of Out-of-range Pointer Offset in Mongoose Web Server library
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space...
Lack of unique constraint validation allows overwriting evaluators
Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...
MGASA-2024-0351 Updated python-werkzeug packages fix security vulnerability
Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parsing multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...
CVE-2023-29114
The CVE-2023-29114 entry concerns Enel X Waybox (JuiceBox) where a lack of access control lets attackers read system logs via the web management interface. The exposed logs contain sensitive credentials and configuration data, including Wi‑Fi credentials, APN web address/credentials, IPsec creden...
PT-2024-25382 · Levelone · Levelone Wbr-6012
Name of the Vulnerable Software and Affected Versions: LevelOne WBR-6012 version R0.40e6 Description: A denial of service issue exists in the Web Application functionality. It can be triggered by a specially crafted HTTP request, leading to a reboot. An attacker can exploit this by sending a...
CVE-2024-48239
An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...
Ifsc Code Finder Project 跨站脚本漏洞
Ifsc Code Finder Project is a web based application by the individual developer Anuj Kumar. It is used to help users find Ifsc code of any bank instantly. A cross-site scripting vulnerability exists in Ifsc Code Finder Project version 1.0, which stems from an unknown manipulation of the file...
Schneider Electric System Monitor Application Information Disclosure Vulnerability
Schneider Electric System Monitor application is a system monitor program in industrial control equipment from Schneider Electric France. An information disclosure vulnerability exists in the Schneider Electric System Monitor application, which stems from the application's lack of protection of...
CVE-2024-39563
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete...
CVE-2024-47828 Cross-Site Request Forgery in ampache
ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to delete objects Playlist, smartlist etc.. Cross-Site Request Forgery CSRF is an attack that forces authenticated users to submit a request to a Web application against which they a...
U.S. Dept Of Defense: Time-based blind SQL injection
A time-based blind SQL injection vulnerability was discovered in the sortBy parameter of the web application's SearchDocs.aspx functionality. The vulnerability was identified by observing differences in the server's response time when specific payloads were used. This type of vulnerability could...
PLANET switch devices 跨站请求伪造漏洞
PLANET switch devices are a series of switch devices from PLANET Corporation in China. The PLANET switch devices suffer from a cross-site request forgery vulnerability, which arises from the vulnerability of a web application to a cross-site request forgery attack, where an attacker can trick a...
PT-2024-22584 · Infinera · Infinera Hit 7300
Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: A web application in the Infinera hiT 7300 allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations. This issue can lead to unauthoriz...
U.S. Dept Of Defense: XSS Reflected
The web application was vulnerable to reflected cross-site scripting XSS attacks. Untrusted data from the URL parameters was included in the application's response without proper sanitization or validation. This allowed an attacker to inject malicious scripts into web pages viewed by other users...
SQL Injection
github.com/navidrome/navidrome is vulnerable to SQL Injection. The vulnerability is due to the lack of proper input validation and escaping of URL parameters in SQL queries, allowing attackers to inject malicious SQL code into the application...
