Siemens 多款产品 安全漏洞

SIMATIC RTLS Locating Manager is used to configure, operate and maintain the SIMATIC RTLS unit, a real-time wireless positioning system that provides locating solutions. A security vulnerability exists in Siemens SIMATIC RTLS Locating Manager due to an affected SIMATIC RTLS Locating Manager...

Apache Airflow 跨站脚本漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow version 2.9.0 suffers from a cross-site scripting vulnerability that...

The vulnerability of the microprogrammed software of the MELSEC iQ-R Series Safety CPU and Series SIL2 Process CPU modules, related to insufficient protection of registration data, allows a intruder to obtain the account information.

The vulnerability of the microprogramming software for MELSEC iQ-R Series Safety CPUs and Series SIL2 Process CPUs is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to obtain login credentials by eavesdropping on...

F5 BIG-IP Configuration Utility Cross-Site Scripting Vulnerability (CNVD-2024-22217)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in the F5 BIG-IP configuration utility, which can be exploited by an attacker to...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A man-in-the-middle attack vulnerability exists in F5 BIG-IP Next Central Manager, which can be exploited by an attacker to ga...

CVE-2024-3543

Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system...

CVE-2024-4225

Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit RTU, by DPS Telecom. Attackers can exploit those security vulnerabilities to perform critical actions such as escalate user's privilege, steal user's credential, Cross Site Scripting XS...

CVE-2024-4225 NGDIN_ST v2.0D.0062 - Multiple Vulnerabilities

Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit RTU, by DPS Telecom. Attackers can exploit those security vulnerabilities to perform critical actions such as escalate user's privilege, steal user's credential, Cross Site Scripting XS...

CVE-2024-4225 NGDIN_ST v2.0D.0062 - Multiple Vulnerabilities

Multiple security vulnerabilities has been discovered in web interface of NetGuardian DIN Remote Telemetry Unit RTU, by DPS Telecom. Attackers can exploit those security vulnerabilities to perform critical actions such as escalate user's privilege, steal user's credential, Cross Site Scripting XS...

CVE-2024-4225

Affected product: NetGuardian DIN RTU Web Interface. Vulnerabilities: Multiple issues enabling privilege escalation, credential theft, XSS and CSRF. Impact (as stated): High confidentiality and integrity impact, low availability. CVSS: 3.1 base score 7.6; attack vector adjacent; privileges requir...

PT-2024-29805 · Unknown · Netguardian Din Remote Telemetry Unit

Name of the Vulnerable Software and Affected Versions: NetGuardian DIN Remote Telemetry Unit RTU affected versions not specified Description: The issue concerns multiple security vulnerabilities in the web interface of the NetGuardian DIN Remote Telemetry Unit RTU. Attackers can exploit these...

CVE-2024-28961

Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A local low privileged malicious user could potentially exploit this vulnerability to obtain credentials leading to unauthorized access with elevated privileges. This could lead to...

DerbyNet order parameter cross-site scripting vulnerability

DerbyNet is a simple code for a match broadcasting program. A cross-site scripting vulnerability exists in the DerbyNet order parameter due to improper validation of user-supplied input by the checkin.php script. An attacker could use this vulnerability to steal the victim's cookie-based...

Androxgh0st Malware Compromises Servers Worldwide for Botnet Attack

By Deeba Ahmed Veriti Research exposes surge in Androxgh0st attacks, exploiting CVEs and building botnets for credential theft. Patch systems, monitor for web shells, and use behavioral analysis to protect yourself. This is a post from HackRead.com Read the original post: Androxgh0st Malware...

@3s-wallet-core/provider (>=0.0.2, <=0.0.3), @3s-wallet-core/wallet (0.0.4) +17 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.87.2, <=1.87.6)

@solana/web3.js NPM version =1.87.2, =0.0.2, =0.0.6, =0.1.9, =2.0.3, =0.0.1-alpha.1, =0.0.2, =2.0.0-alpha.15, =0.1.3-rc.1, =3.0.4-1, =0.2.2, =1.11.3-nobnb, =1.0.0, =1.1.0 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

PT-2024-3523

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service Confidential Container affected versions not specified Description: The issue is related to a lack of access control in the deployment and management of confidential containers in Azure Kubernetes Service,...

Orange Station 1.0 Shell Upload

Title: ORANGE STATION-1.0 File Upload Remote Code Execution Vulnerability Author: nu11secur1ty Date: 03/26/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html Reference:...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-21668)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Threat actors leverage document publishing sites for ongoing credential and session token theft

Cisco Talos Incident Response Talos IR has observed the ongoing use of legitimate digital document publishing DDP sites for phishing, credential theft and session token theft during recent incident response and threat intelligence engagements. Hosting phishing lures on DDP sites increases the...

CVE-2024-24818 EspoCRM weakness in "Forgot password"

EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2...