CVE-2024-31963

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A...

CVE-2024-31963

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A...

CVE-2024-31966

The CVE-2024-31966 issue affects Mitel 6800 Series and 6900 Series SIP Phones (through 6.3 SP3 HF4), Mitel 6900w Series SIP Phone (through 6.3.3), and Mitel 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient parameter sanitization, allowing an authenticated attacker with adm...

Meinberg LANTIME Improper Filename Validation of the Upload Function (CVE-2023-1731)

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands. This plugin only works with Tenable.ot. Please visit...

CVE-2024-31966

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct an argument injection attack due to insufficient paramete...

CVE-2024-31963

Mitel 6800/6900 Series SIP Phones (through 6.3 SP3 HF4; 6900w through 6.3.3; 6970 Conference Unit through 5.1.1 SP8) are affected by a buffer overflow caused by insufficient bounds checking and input sanitization. The vulnerability allows an authenticated attacker to access sensitive information,...

CVE-2024-28764 IBM WebSphere Automation CSV injection

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

CVE-2024-28764 IBM WebSphere Automation CSV injection

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

CVE-2024-28764

IBM WebSphere Automation 1.7.0 is affected by a CSV injection vulnerability caused by improper validation of CSV file contents. An attacker with privileged network access could execute arbitrary commands on the system (impacting confidentiality, integrity, and availability). The issue stems from ...

Security Bulletin: Vulnerabilities in OpenSSH, Linux Kernel might affect IBM Storage Copy Data Management

Summary IBM Storage Copy Data Management can be affected by vulnerabilities in OpenSSL and Linux Kernel. A remote or local authenticated attacker could exploit these vulnerabilities to break SSH extension negotiation and downgrading the client connection security, to cause the system to crash, to...

BMC software fails to validate IPMI session.

Overview The Intelligent Platform Management Interface IPMI implementations in multiple manufacturer's Baseboard Management Controller BMC software are vulnerable to IPMI session hijacking. An attacker with access to the BMC network with IPMI enabled can abuse the lack of session integrity to...

USN-6756-1: less vulnerability

It was discovered that less mishandled newline characters in file names. If a user or automated system were tricked into opening specially crafted files, an attacker could possibly use this issue to execute arbitrary commands on the host...

Command Injection

dcnnt is vulnerable to Command Injection. The vulnerability is due to improper input validation within notifications.py of Notification Handler, allowing remote attackers to execute arbitrary commands...

CVE-2024-4301

N-Reporter and N-Cloud (N-Partner) are affected by CVE-2024-4301 through an OS command injection vulnerability that allows remote attackers with low privileges to execute arbitrary system commands by manipulating inputs on a specific page. The vulnerability is described across multiple sources; N...

PT-2024-25180 · Prestaddons · Prestaddons Flashsales

Name of the Vulnerable Software and Affected Versions: Prestaddons flashsales versions 1.9.7 and earlier Description: The issue allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method, potentially leading to unauthorized data access or modification. Recommendations:...

PT-2024-25187 · Unknown · Fme Modules Preorderandnotication

Name of the Vulnerable Software and Affected Versions: FME Modules preorderandnotication versions 3.1.0 and earlier Description: The issue allows a remote attacker to execute arbitrary SQL commands via the PreorderModel::getIdProductAttributesByIdAttributes method. This enables the attacker to...

CVE-2024-33266

CVE-2024-33266: SQL injection in Helloshop deliveryorderautoupdate up to v2.8.1 allows an attacker to execute arbitrary SQL via DeliveryorderautoupdateOrdersModuleFrontController::initContent. Root cause is unsafe handling of input in that controller, leading to unauthorized DB queries with poten...

CVE-2024-33266

SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the DeliveryorderautoupdateOrdersModuleFrontController::initContent function...

Fedora 40 : csmock (2024-c49fc0b05f)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c49fc0b05f advisory. - update to latest upstream fixes CVE-2024-2243 Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

RHEL 7 : CloudForms 4.5.5 (RHSA-2018:2745)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2745 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...