CVE-2024-27202 BIG-IP TMUI XSS vulnerability

A DOM-based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Sensitive Information Disclosure

org.eclipse.edc: data-plane-http-oauth2-core is vulnerable to Sensitive Information Disclosure. The vulnerability arises from a misconfiguration in the OAuth2-protected data sink feature, where the consumer-provided clientSecretKey is resolved in the context of the provider's vault instead of the...

PT-2024-25370 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: A reflected cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility. This allows an attacker to run JavaScript in the context of the currently...

PT-2024-23798 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility, allowing an attacker to run JavaScript in the context of the currently...

CVE-2023-35748

D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit...

CVE-2022-43654

NETGEAR CAX30S SSO Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30S routers. Authentication is not required to exploit this vulnerability. The specific flaw exists with...

CVE-2021-34982

NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The...

CVE-2023-35748 D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-2622 DDP Firmware Upgrade Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit...

CVE-2022-43654

Summary: CVE-2022-43654 affects NETGEAR CAX30S routers via a pre-auth RCE caused by improper validation of a user-supplied string in the token parameter passed to the sso.php endpoint, allowing a network-adjacent attacker to execute code as root. The issue is described as a command injection vuln...

CVE-2021-34965

CVE-2021-34965 describes a use-after-free in Foxit PDF Editor’s Squiggly Annotation handling. The flaw arises from not validating the existence of an Annotation object before operations, enabling an attacker to execute code in the context of the target process. The vulnerability requires user int...

CVE-2021-34947

The CVE-2021-34947 entry describes a NETGEAR R7800 net-cgi Out-of-Bounds Write Remote Code Execution vulnerability. The flaw is in parsing of the soap_block_table, caused by insufficient validation of user-supplied data, allowing a write past the end of an allocated structure. This enables networ...

SUSE CVE-2022-48673

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IBWCWRFLUSHERR status. Current implementation does not wait for it is done, but destroy...

The vulnerability of the ModuleInvoke class in SCADA systems of Inductive Automation Ignition allows a perpetrator to execute arbitrary code.

The vulnerability of the ModuleInvoke class in the SCADA system of Inductive Automation Ignition involves the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the SYSTEM context...

Triangle MicroWorks SCADA Data Gateway 安全漏洞

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. A security vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which is caused by a specific flaw in the Restore Workspace feature that can be exploited by an attacker to execute code...

CVE-2024-34089

An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When...

RLSA-2024:2098 Important: container-tools:rhel8 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Bug Fixes: containerinitt does not possess ptrace process context rhel-8.9.0.z JIRA:Rocky Linux-28923 Security Fixes: podman: full container escape at build time CVE-2024-1753...

PT-2024-40765 · Git +1 · Boringssl

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the ssl ctx make profiles function. Technical details...

BIT-ACTIVEMQ-2024-32114

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located.It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia JM...

CVE-2022-48673

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IBWCWRFLUSHERR status. Current implementation does not wait for it is done, but destroy...

DEBIAN-CVE-2022-48673

In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error state, all RX WR would be completed with WC in IBWCWRFLUSHERR status. Current implementation does not wait for it is done, but destroy...