The vulnerability of the Loway QueueMetrics software for analyzing call center performance metrics lies in its inability to properly handle incoming requests, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Loway QueueMetrics performance analysis software lies in the inconsistency of its responses to incoming requests. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information by sending specially crafted...

SQL Injection

github.com/apache/trafficcontrol is vulnerable to SQL Injection. The vulnerability is due to improper input validation in Traffic Ops, allowing a privileged user with roles such as "admin," "federation," "operations," "portal," or "steering" to execute arbitrary SQL queries through...

The vulnerability of the Fortinet FortiClient Enterprise Management Server (EMS) server lies in the incorrect path limitation for the restricted access directory. This allows a malicious actor to perform service denial-of-service attacks, read from or write to a limited number of files.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server relates to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to perform maintenance actions, read from or write to a limited number of...

The vulnerability of Backstage’s portal-building platform lies in its uncontrolled modification of object prototype attributes, allowing attackers to trigger service failures.

The vulnerability of the Backstage developer portal-building platform lies in the uncontrolled modification of object prototype attributes. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures by sending a specially crafted API request...

The vulnerability of the plugins_call_handle_uri_clean() function in the /sbin/lighttpd microprogramming system of D-Link DAP-1520 wireless signal amplifiers allows a hacker to induce a service failure.

The vulnerability of the pluginscallhandleuriclean function in the /sbin/lighttpd microprogramming system for D-Link DAP-1520 wireless signal amplifiers is related to errors in pointer assignment due to incorrect checking of HTTP request formats. Exploiting this vulnerability could allow an...

The vulnerability of the /sbin/httpd microprogramming system used in wireless access points DAP-2555 allows a attacker to cause a service failure.

The vulnerability of the /sbin/httpd microprogramming system used by D-Link DAP-2555 wireless access points is related to the escape of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially crafted HTTP...

CVE-2024-28767 IBM Security Directory Integrator command execution

IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

IBM Security Directory Integrator 操作系统命令注入漏洞

IBM Security Directory Integrator is an integrated development environment and runtime service from International Business Machines IBM. IBM Security Directory Integrator suffers from an operating system command injection vulnerability that stems from the application's failure to properly filter...

The vulnerability of the Apache Superset data visualization software lies in its authentication procedures’ flaws, which allow unauthorized users to gain unauthorized access to read, modify, or delete data.

The vulnerability of Apache Superset’s data visualization software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to read, modify, or delete data by sending specially crafted request...

The vulnerability of the backup and data recovery software for Veeam Service Provider Console (VSPC) users on remote and cloud-based clients stems from insufficient protection of operational data, allowing attackers to exploit this weakness to disclose sensitive information.

The vulnerability of the backup and data restoration software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to insufficient protection of operational data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information by...

org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

A flaw was found in Jetty's ThreadLimitHandler.getRemote. This flaw allows unauthorized users to cause remote denial of service DoS attacks. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory...

Amazon Linux 2022 : httpd, httpd-devel, httpd-filesystem (ALAS2022-2022-018)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-018 advisory. There's a null pointer dereference and server-side request forgery flaw in httpd's modproxy module, when it is configured to be used as a forward proxy. A crafted packet could be sent on the...

Vulnerabilities fixed in Atlassian products

Atlassian has fixed vulnerabilities in several products such as Jira, Bamboo and Confluence. The vulnerabilities are in several third-party components from developers such as Oracle, RedHat and the Apache consortium. These vulnerabilities can lead to memory exhaustion and denial-of-service DoS du...

Planet WGS-804HPT 安全漏洞

Planet WGS-804HPT is an industrial 8-port 10/100/1000T wall-mounted managed switch from Planet, China. A security vulnerability exists in the Planet WGS-804HPT. An attacker could exploit this vulnerability to send a malicious HTTP request that would cause the web server to remotely execute code b...

The vulnerability of the sub_42EA38 function in Tenda RX9 and RX9 Pro microprogramming devices allows a hacker to induce a service failure.

The vulnerability of sub42EA38 in the microprogramming software of Tenda RX9 and RX9 Pro relates to writing beyond buffer boundaries. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending a specially crafted POST request...

Denial Of Service (DoS)

io.undertow, undertow-core is vulnerable to Denial of Service DoS. The vulnerability is due to an OutOfMemory error caused by a malicious user sending crafted requests through the FormAuthenticationMechanism, allowing an attacker to trigger the error...

Arbitrary File Upload

Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Arbitrary File Upload due to the dynamicthumbnails option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or...

The vulnerability of the Fortinet FortiManager software for centralized device management, as well as the FortiAnalyzer and FortiAnalyzer-BigData tools for event monitoring and analysis, stems from deficiencies in access control to personal information. This allows attackers to read event logs from other domains.

The vulnerability of the Fortinet FortiManager software for centralized device management, as well as the FortiAnalyzer and FortiAnalyzer-BigData tools for security event monitoring and analysis, is related to deficiencies in access control for personal information. Exploiting this vulnerability...

PT-2024-26933 · Sharp +1 · Multiple Mfps +18

Name of the Vulnerable Software and Affected Versions: Affected devices affected versions not specified Description: The web interface of the affected devices processes some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef sub sel.htm...

The vulnerability of the formSetSysTime function in the wireless access point software Tenda G3 allows a intruder to execute arbitrary code.

The vulnerability of the formSetSysTime function in the wireless access point software Tenda G3 is related to buffer overflows based on a stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending specially crafted POST requests...