342754 matches found
CVE-2024-31201
CVE-2024-31201 affects the ThermoscanIP Scrutation service. The root cause is a CWE-428 Unquoted Search Path or Element, which can be abused when the C:\ path permissions are misconfigured, potentially enabling local privilege escalation. Exploitation details are not provided in the documents. Re...
CVE-2024-31200
A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser...
CVE-2024-31200
CVE-2024-31200 is documented across multiple feeds with concrete details: CWE-201 Insertion of Sensitive Information Into Sent Data, allowing retrieval of passwords in cleartext from an admin browser session when the attacker has physical access. Connected records identify Plug&Track Sensor Net C...
CVE-2024-31200
A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser...
CVE-2024-31199
A “CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'” allows malicious users to permanently inject arbitrary Javascript code...
CVE-2024-31199
A “CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'” allows malicious users to permanently inject arbitrary Javascript code...
CVE-2024-31199
CVE-2024-31199 is associated with a cross-site scripting issue (CWE-79) described across several sources as improper neutralization of input during web page generation, enabling malicious users to inject arbitrary Javascript. Connected documentation identifies Plug&Track Sensor Net Connect V2 as ...
CVE-2024-3083
CVE-2024-3083 corresponds to a CSRF vulnerability in Plug&Track Sensor Net Connect (V2). Affected component: Plug&Track Sensor Net Connect V2, version 2.24. Root cause: cross-site request forgery that can enable remote attackers to perform state-changing operations with administrative privileges ...
CVE-2024-3083
A “CWE-352: Cross-Site Request Forgery CSRF” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page...
CVE-2024-3082
A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers e.g., full-disk encryption have been enabled...
CVE-2024-3082
A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext unless specific security measures at other layers e.g., full-disk encryption have been enabled...
CVE-2024-3082
CVE-2024-3082 describes a CWE-256 issue where plaintext storage of the administrative password enables a physical attacker to read the cleartext password. Public sources (NVD, Red Hat, CVE listing aggregations, CNNVD, PT-Security) tie this to admin credentials exposed on the device, with mitigati...
CVE-2024-41702
SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
CVE-2024-41702
CVE-2024-41702 corresponds to a SiberianCMS SQL injection due to the system’s failure to properly neutralize special elements in SQL commands. CNVD-2024-35164 describes that the vulnerability allows an attacker to execute arbitrary SQL to obtain sensitive information or gain database control. Oth...
CVE-2024-41693
Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...
CVE-2024-41695
Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory...