GHSA-W7HQ-F2PJ-C53G pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

Summary The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file can be downloaded to such...

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents allows a perpetrator to activate additional functions of the device.

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents is related to the presence of undocumented configuration commands. Exploiting this vulnerability can allow attackers to activate additional functions of the device by modifying the configuration files...

MTN Group: Cisco IOS XE instance at ████ vulnerable to CVE-██████

A vulnerability was discovered in a Cisco IOS XE instance that allowed bypassing authentication to reach a web endpoint and execute arbitrary Cisco IOS commands or make configuration changes with Privilege 15 privileges. The vulnerability was characterized by improper path validation to bypass...

Cisco IOS Software Web UI XSRF (cisco-sa-ios-webui-HfwnRgk)

According to its self-reported version, Cisco IOS is affected by a vulnerability. - A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system throu...

CVE-2024-20414

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration...

CVE-2024-20414

CVE-2024-20414 affects Cisco IOS Software and Cisco IOS XE Software Web UI. The issue is a CSRF flaw caused by accepting configuration changes via HTTP GET, allowing a remote attacker to trick an authenticated administrator into changing device config. Exploitation could change settings without a...

Cisco IOS and IOS XE Software Web UI Cross-Site Request Forgery Vulnerability

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration...

CIRCUTOR TCP2RS+ 输入验证错误漏洞

CIRCUTOR TCP2RS+ is an Ethernet converter from CIRCUTOR. An input validation error vulnerability exists in CIRCUTOR TCP2RS+ version 1.3b, which originates from a vulnerability that allows an attacker to modify any configuration value without authentication, resulting in invalidating the device's...

CVE-2024-8956

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can...

CVE-2024-31415

The CVE-2024-31415 issue affects Eaton Foreseer EPMS software. The root cause is insecurely stored encryption keys used to protect server configuration data, allowing an attacker with local access to potentially change or remove external server configurations. Public documents describe the vulner...

PT-2024-10394 · Cisco · Cisco Optical Site Manager +3

Name of the Vulnerable Software and Affected Versions: Cisco Crosswork Network Services Orchestrator NSO affected versions not specified Cisco ConfD affected versions not specified Cisco Optical Site Manager affected versions not specified Cisco RV340 Dual WAN Gigabit VPN Routers affected version...

CVE-2024-43392

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWINCOMING.FROMIP FWINCOMING.INIP FWOUTGOING.FROMIP FWOUTGOING.INIP environment variable which can lead to a DoS...

CVE-2024-43392

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWINCOMING.FROMIP FWINCOMING.INIP FWOUTGOING.FROMIP FWOUTGOING.INIP environment variable which can lead to a DoS...

CVE-2024-43393

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWINCOMING.FROMIP FWINCOMING.INIP FWOUTGOING.FROMIP FWOUTGOING.INIP FWRULESETS.FROMIP FWRULESETS.INIP environment...

CVE-2024-43389

A low privileged remote attacker can perform configuration changes of the ospf service through OSPFINTERFACE.SIMPLEKEY, OSPFINTERFACE.DIGESTKEY environment variables which can lead to a DoS...

CVE-2024-43391

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWPORTFORWARDING.SRCIP environment variable which can lead to a DoS...

CVE-2024-43393 Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWINCOMING.FROMIP FWINCOMING.INIP FWOUTGOING.FROMIP FWOUTGOING.INIP FWRULESETS.FROMIP FWRULESETS.INIP environment...

CVE-2024-43393

CVE-2024-43393 affects Phoenix Contact MGUARD (FL/TC MGUARD) devices. A low-privileged remote attacker can alter firewall configuration (packet filtering/forwarding, NAC, NAT) via the environment variables FW_INCOMING.FROM_IP, FW_INCOMING.IN_IP, FW_OUTGOING.FROM_IP, FW_OUTGOING.IN_IP, FW_RULESETS...

CVE-2024-43391

CVE-2024-43391 describes a DoS affecting Phoenix Contact FL/TC MGUARD devices. A low-privileged remote attacker can trigger configuration changes of firewall services by manipulating the FW_PORTFORWARDING.SRC_IP environment variable, potentially impacting packet filtering, forwarding, network acc...

CVE-2024-43390 Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FWNAT.INIP environment variable which can lead to a DoS...