3965 matches found
CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/logentries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana...
PT-2025-2949 · Elastic · Kibana
Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to "/api/log entries/summary". This can be carried out by users wi...
The vulnerability of the Windows Telephony Service in Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the Windows Telephony Service in Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a request to the server...
CVE-2024-45061
A cross-site scripting xss vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...
CVE-2024-47002
Observium CE 24.4.13528 is affected by a cross‑site HTML code injection in VLAN management. The vulnerability is a reflected XSS due to improper handling of the vlan_id parameter in the VLAN page (html/pages/vlan.inc.php). An authenticated user can trigger arbitrary HTML/JS by clicking a maliciou...
CVE-2023-42785
A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request...
Fortinet FortiSIEM SQL注入漏洞
Fortinet FortiSIEM is a security information and event management system from Fortinet, Inc. The system includes features such as asset discovery, workflow automation, and unified management. Fortinet FortiSIEM suffers from an SQL injection vulnerability that stems from improper neutralization of...
Fortinet FortiOS 安全漏洞
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS has a security...
Fortinet FortiDeceptor 访问控制错误漏洞
Fortinet FortiDeceptor is a cyber threat detection platform from the American company Fiat Fortinet. The platform focuses on exposing cyber threats through deception techniques, among other things. Fortinet FortiDeceptor suffers from an Access Control Error vulnerability that stems from the...
Arcadyan Meteor 2 CPE 安全漏洞
Arcadyan Meteor 2 CPE is a high-end home integrated access device from China Smart Arcadyan. A security vulnerability exists in the Arcadyan Meteor 2 CPE FG360 Firmware ETV version 2.10. An attacker can exploit the vulnerability to execute arbitrary code via a specially crafted request...
IBM Engineering Requirements Management DOORS Next 安全漏洞
IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. A security vulnerability exists in IBM Engineering Requirements Managemen...
ASUS System Analysis IO 安全漏洞
ASUS System Analysis IO is a module in a diagnostic software from Asus China. A security vulnerability exists in ASUS System Analysis IO version 1.0.0, which stems from a problem with the AsusSAIO.sys component that allows an attacker to perform arbitrary read and write operations by supplying a...
Next.js 安全漏洞
Next.js is a React framework open-sourced by Vercel. Next.js suffers from a security vulnerability that stems from vulnerability to a denial of service DoS attack, where an attacker can construct a request to operate on the server to be in a hung state until the hosting provider cancels the...
The vulnerability in the web interface for managing D-Link DIR-823G microprogramming routers allows a hacker to alter the device’s configuration.
The vulnerability of the web interface for managing D-Link DIR-823G microprogramming devices is related to errors in privilege management. Exploiting this vulnerability allows a malicious actor to alter the device’s configuration by sending a specially crafted HTTP POST request...
PT-2024-9868 · Totolink · Totolink A3002Ru
Name of the Vulnerable Software and Affected Versions: Totolink A3002R affected versions not specified Description: The issue is related to the formWsc function of the Totolink A3002R router's firmware, which fails to take measures to protect the web page structure. This can be exploited by a...
The vulnerability of the formWsc function in the microprogramming software of the Totolink A3002R router allows a intruder to execute arbitrary code.
The vulnerability of the formWsc function in the Totolink A3002R router’s microprogramming software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...
CVE-2024-28767
IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...
Trellix ePolicy Orchestrator 跨站脚本漏洞
Trellix ePolicy Orchestrator is a centralized security management platform from FireEye Trellix USA. A cross-site scripting vulnerability exists in Trellix ePolicy Orchestrator versions prior to 5.10 Service Pack 1 Update 3. An attacker could use this vulnerability to inject arbitrary content int...
CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse
Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore::LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...