18138 matches found
CVE-2024-24999
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24994
CVE-2024-24994 describes a path traversal vulnerability in the web component of Ivanti Avalanche prior to version 6.4.3. An authenticated remote attacker can exploit this to execute arbitrary commands as SYSTEM. The issue is the result of improper path validation and restricted directory enforcem...
Ivanti Avalanche 安全漏洞
Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche prior to version 6.4.3, which stems from a path traversal...
Fedora 39 : php (2024-b46619f761)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b46619f761 advisory. PHP version 8.2.18 11 Apr 2024 Core: Fixed bug GH-13612 Corrupted memory in destructor with weak references. nielsdos Fixed bug GH-13784...
The vulnerability of the Avalanche device management system, related to synchronization errors when using a common resource (“Race Situation”), allows a hacker to execute arbitrary commands with SYSTEM privileges.
The vulnerability of the Avalanche device management system is related to synchronization errors when using a common resource “Race Situation”. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with SYSTEM privileges...
The vulnerability of the WLAvalancheService component in the Avalanche mobile device management system allows a attacker to execute arbitrary commands with SYSTEM privileges.
The vulnerability of the WLAvalancheService component in the mobile device management system of Avalanche relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands with SYSTEM privileges...
The vulnerability of the Avalanche device management system, related to incorrect restrictions on the path name to the restricted access catalog, allows a perpetrator to execute arbitrary commands with SYSTEM privileges.
The vulnerability of the Avalanche device management system is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with SYSTEM privileges remotely...
Ivanti Avalanche Heap Overflow Vulnerability
Ivanti Avalanche is a mobile device management MDM software platform designed to help organizations manage, maintain and secure their mobile devices. It supports a range of device types, including smartphones, tablets, and industrial devices. A heap overflow vulnerability exists in Ivanti Avalanc...
VulnCheck KEV: CVE-2023-37679
A remote command execution RCE vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server...
The vulnerability of the svc_udoctor utility in the operating system for managing and maintaining the Dell Unity Operating Environment’s data storage allows a malicious actor to execute arbitrary commands.
The vulnerability of the svcudoctor utility in the operating environment for managing and maintaining the Dell Unity Operating Environment exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an...
Tenda W30E Command Injection Vulnerability
The Tenda W30E is a wireless router device that provides Internet access, wireless coverage and more. A command injection vulnerability exists in the formWriteFacMac function of the /goform/WriteFacMac file in version 1.0.1.25633 of the Tenda W30E, which can be exploited by an attacker to execute...
CVE-2024-30928
SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc...
CVE-2024-30985
SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "todate" and "fromdate" parameters...
CVE-2024-30982
SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands via the upid parameter in the /view-user-detail.php file...
CVE-2024-30985
CVE-2024-30985 affects phpgurukul Client Management System version 1.1. The vulnerability is a SQL Injection in the B/W Dates Reports page, exploitable via the todates/fromdate parameters, enabling arbitrary SQL execution. CVSS: 3.1, 9.8 base score (CRITICAL); impact on confidentiality, integrity...
CVE-2024-2912
CVE-2024-2912 (BentoML) has documented insecure deserialization leading to remote code execution (RCE). The vulnerability arises when a serialized object is crafted to execute OS commands during deserialization and sent to BentoML endpoints via POST requests, allowing attackers to run arbitrary c...
By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)
By default, SANnav OVA is shipped with root user login enabled. Product Affected All Brocade OVA SANnav versions Mitigation Starting with SANnav OVA version v2.3.0 and later versions, a root account is not required for installation and management of the SANnav. If an administrator is uncomfortabl...
Small CRM SQL Injection Vulnerability (CNVD-2025-23151)
Small CRM is a customer relationship management system. A SQL injection vulnerability exists in Small CRM, which stems from a lack of validation of externally-entered SQL statements in the change password handler. An attacker can exploit this vulnerability to execute illegal SQL commands to steal...