342662 matches found
CVE-2024-40587
Summary: CVE-2024-40587 is an OS Command Injection in Fortinet FortiVoice. FortiVoice versions 7.0.0–7.0.4 and prior to 6.4.9 are affected. The root cause is improper neutralization of special elements used in OS commands, allowing an authenticated privileged attacker to execute unauthorized code...
CVE-2024-12298 Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer
We found a vulnerability Improper Restriction of XML External Entity Reference CWE-611 in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer...
Wavlink AC3000 wireless.cgi DeleteMac() buffer overflow vulnerability
Talos Vulnerability Report TALOS-2024-2040 Wavlink AC3000 wireless.cgi DeleteMac buffer overflow vulnerability January 14, 2025 CVE Number CVE-2024-39359 SUMMARY A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac functionality of Wavlink AC3000 M33A8.V5030.210505. A...
Wavlink AC3000 openvpn.cgi openvpn_client_setup() Configuration Control Vulnerability
Talos Vulnerability Report TALOS-2024-2051 Wavlink AC3000 openvpn.cgi openvpnclientsetup Configuration Control Vulnerability January 14, 2025 CVE Number CVE-2024-38666 SUMMARY An external config control vulnerability exists in the openvpn.cgi openvpnclientsetup functionality of Wavlink AC3000...
Wavlink AC3000 adm.cgi set_TR069() buffer overflow vulnerability
Talos Vulnerability Report TALOS-2024-2029 Wavlink AC3000 adm.cgi setTR069 buffer overflow vulnerability January 14, 2025 CVE Number CVE-2024-37357 SUMMARY A buffer overflow vulnerability exists in the adm.cgi setTR069 functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP...
Fortinet Fortigate IPsec dynamic assignation IP spoofing (FG-IR-23-407)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-407 advisory. - An origin validation error CWE-346 vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2....
Wavlink AC3000 adm.cgi set_wzdap() buffer overflow vulnerability
Talos Vulnerability Report TALOS-2024-2027 Wavlink AC3000 adm.cgi setwzdap buffer overflow vulnerability January 14, 2025 CVE Number CVE-2024-39358 SUMMARY A buffer overflow vulnerability exists in the adm.cgi setwzap functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP...
Wavlink AC3000 touchlist_sync.cgi touchlistsync() command injection vulnerability
Talos Vulnerability Report TALOS-2024-2000 Wavlink AC3000 touchlistsync.cgi touchlistsync command injection vulnerability January 14, 2025 CVE Number CVE-2024-34166 SUMMARY An os command injection vulnerability exists in the touchlistsync.cgi touchlistsync functionality of Wavlink AC3000...
Wavlink AC3000 nas.cgi remove_dir() Command Injection Vulnerability
Talos Vulnerability Report TALOS-2024-2054 Wavlink AC3000 nas.cgi removedir Command Injection Vulnerability January 14, 2025 CVE Number CVE-2024-39360 SUMMARY An os command injection vulnerability exists in the nas.cgi removedir functionality of Wavlink AC3000 M33A8.V5030.210505. A specially...
Security Bulletin: IBM OpenPages vulnerable to exposure of sensitive information through improper authorization controls on APIs. (CVE-2024-43176)
Summary A vulnerability caused by improper authorization checks could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. Vulnerability Details CVEID:CVE-2024-43176 DESCRIPTION: IBM OpenPages could allow an...
CVE-2024-47926 Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
CVE-2024-47926 Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
CVE-2024-47926
Tecnick TCExam is affected by a SQL Injection (CWE-89) due to improper neutralization of special elements in SQL commands. The CVE-2024-47926 entry indicates a high-impact vulnerability with CVSS v3.1 base score 9.8 (Network attack vector, low complexity, no privileges required, user interaction ...
CVE-2024-47923
CVE-2024-47923 affects Mashov (instructional management system). Multiple sources indicate an information disclosure (CWE-200) vulnerability where sensitive data could be exposed to unauthorized actors. CNNVD specifies affected versions: Mashov prior to 3.8.32; potential remediation would be to u...
CVE-2024-47919 Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...
CVE-2024-47919
CVE-2024-47919 affects Tiki Wiki CMS Groupware before version 28.0. The issue is an OS Command Injection stemming from improper neutralization of special elements in operating system commands (CWE-78). Documented impact in affected entries indicates high severity with potential remote exploitatio...
CVE-2024-47918 Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...
Security Bulletin: IBM SPSS Analytic Server is affected by netty vulnerability (CVE-2024-29025)
Summary IBM SPSS Analytic Server uses netty-codec-http-4.1.100.Final.jar which is vulnerable to CVE-2024-29025. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-29025 DESCRIPTION: Netty is an asynchronous event-driven network...
CVE-2024-48889
FortiManager OS Command Injection (CVE-2024-48889) affects FortiManager and FortiManager Cloud across multiple versions (e.g., 7.6.0, 7.4.x, 7.2.x, 7.0.x, 6.4.x) via FGFM crafted requests. Root cause: improper neutralization of special elements in OS commands, enabling an authenticated remote att...
