CVE-2024-33897

A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024...

CVE-2024-33897

The CVE-2024-33897 issue affects HMS Networks Cosy+ remote-access devices where a compromised Cosy+ could request a Certificate Signing Request (CSR) from Talk2m for another device, creating an availability risk. Root cause: improper handling of CSR requests via Talk2m could be abused, as describ...

AGCA – Custom Dashboard & Login Page < 7.2.2 - Admin+ Stored XSS via Image URL

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Navigate AGCA, and select the "Adm...