CVE-2024-40405

Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-28729

Effected product: D-Link DWR-2000M 5G CPE with WiFi 6 Ax1800 (DWR-2000M 1.34ME) and D-Link DWR-2000M 5G CPE (DWR-2000M 1.34ME). Issue: allows a local attacker to execute arbitrary code via a crafted request. Root cause details are not provided in the documents. Impact: high (arbitrary code execut...

Zyxel GS1900 安全漏洞

Zyxel GS1900 is a managed switch from China Hopkins Zyxel. A security vulnerability exists in Zyxel GS1900 V2.80AAHN.1C0 and earlier versions, which stems from the presence of a post-authentication command injection vulnerability that could allow an authenticated attacker with administrator...

D-Link DWR-2000M 安全漏洞

The D-Link DWR-2000M is a wireless router from China AUO D-Link. A security vulnerability exists in the D-Link DWR-2000M. A local attacker can exploit the vulnerability to execute arbitrary code via a crafted request...

CVE-2024-28729

An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M1.34ME allows a local attacker to execute arbitrary code via a crafted request...

CVE-2024-51135

An XML External Entity XXE vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

CVE-2024-51135

CVE-2024-51135 describes an XML External Entity (XXE) vulnerability in the powertac-server component, specifically in DocumentBuilderFactory used by powertac-server v1.9.0. Exploitation could allow an attacker to access sensitive information or execute arbitrary code by supplying crafted XML enti...

The vulnerability of the fromNatlimit function in the microprogramming software for Tenda FH1206 allows a hacker to trigger a service failure.

The vulnerability of the fromNatlimit function in the microprogramming-based router software Tenda FH1206 is caused by a buffer overflow in the queue. Exploiting this vulnerability can allow an attacker, operating remotely, to cause a service failure through a specially created POST request...

CVE-2024-20537

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker...

CVE-2024-20527

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20536

Cisco Nexus Dashboard Fabric Controller (NDFC) SQL Injection vulnerability affects REST API endpoint and web-based management interface. Root cause: insufficient validation of user input enables authenticated, read-only attackers to cause arbitrary SQL commands, potentially reading, modifying, or...

CVE-2024-20532

Cisco ISE exposes an API vulnerability that allows an authenticated, remote attacker with Super Admin credentials to read and delete arbitrary files on the device due to insufficient parameter validation. The issue affects the ISE API layer and stems from weak input validation in API requests, en...

CVE-2024-20532 Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

CVE-2024-20531 Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery SSRF attack through an affected device. To exploit this vulnerability, the attacker woul...

CVE-2024-51132

A flaw was found in Fast Healthcare Interoperability Resources HAPI FHIR. This vulnerability could allow attackers to execute arbitrary code or access sensitive information via a crafted request which contains malicious XML entities. Mitigation Red Hat has investigated whether a possible mitigati...

The vulnerability of the microprogrammed software in PTZOptics PT30X-SDI/NDI webcams arises from incorrect authentication used in the operating system’s command sequence. This allows a hacker to execute arbitrary code.

The vulnerability of the microprogrammed webcam software from PTZOptics PT30X-SDI/NDI is related to incorrect authentication. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted request without an HTTP CGI script authentication head...

CVE-2024-51132

An XML External Entity XXE vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities...

CVE-2024-52020

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at wizfix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...