ABB Cylon Aspect 3.07.02 (user.properties) Default Credentials

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller uses a weak set of default administrative...

Oracle Linux 8 : firefox (ELSA-2024-7977)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-7977 advisory. 128.3.1-2.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.3.1 - Add debranding patches Mustafa Gezen - Add OpenELA default preference...

CVE-2024-48987

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.

...

PT-2024-33316 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 7.0.10 Description: The issue allows remote code execution when an attacker knows the APP KEY, which is associated with cookie serialization. This is worsened by the availability of .env files from the product's...

UBUNTU-CVE-2024-48933

A cross-site scripting XSS vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters...

CVE-2024-48933

A cross-site scripting XSS vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that allows special HTML characters...

The vulnerability of the installation package for microprogramming software in embedded network controllers for building control systems, ASPECT Enterprise, NEXUS Series, MATRIX Series, allows a intruder to gain full control over the device.

The vulnerability of the installation package for microprogramming software in ASPECT Enterprise, NEXUS Series, and MATRIX Series embedded network controllers is related to the use of default account data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full contr...

PT-2024-7844 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 20.4R3-S9-EVO Junos OS Evolved version 21.2-EVO prior to 21.2R3-S7-EVO Junos OS Evolved version 21.4-EVO prior to 21.4R3-S5-EVO Junos OS Evolved version 22.1-EVO prior to 22.1R3-S5-EVO Junos OS Evolved versi...

firefox security update

128.3.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.3.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 128.3.0-1 - Update to 128.3.0...

Metasploit Weekly Wrap-Up 10/04/2024

New module content 3 cups-browsed Information Disclosure Authors: bcoles and evilsocket Type: Auxiliary Pull request: 19510 contributed by bcoles Path: scanner/misc/cupsbrowsedinfodisclosure Description: Adds scanner module to retrieve CUPS version and kernel version information from cups-browsed...

Acronis Cyber Infrastructure Default Password Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'sshkey' class MetasploitModule 'Acronis Cyber Infrastructure default password remote code execution', 'Description' = %q Acronis Cyber Infrastructure ACI is an ...

Acronis Cyber Infrastructure Default Password Remote Code Execution Exploit

Acronis Cyber Infrastructure ACI is an IT infrastructure solution that provides storage, compute, and network resources. Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and software-defined networks, running cloud-native...

Online Eyewear Shop 1.0 Insecure Settings

============================================================================================================================================= | Title : Online Eyewear Shop v1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

NVIDIA Container Toolkit < 1.16.2 Multiple Vulnerabilities

The version of NVIDIA Container Toolkit installed on the remote host is prior to 1.16.2. It is, therefore, affected by multiple vulnerabilities as referenced in the September 2024 Security Bulletin. - NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use TOCTOU...

CVE-2024-8037

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJUCONTEXTID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a...

CVE-2024-8037

Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJUCONTEXTID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a...

Teacher Subject Allocation Management System 1.0 Insecure Settings

==================================================================================================================================== | Title : Teacher Subject Allocation Management System 1.0 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozil...

Microsoft Office NTLMv2 Disclosure

Exploit Title: Microsoft Office NTLMv2 Disclosure Vulnerability Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.office.com/ Software Link: https://www.office.com/ Details: https://github.com/passtheticket/CVE-2024-38200 Version: Microsoft Office 2019 MSO Build 1808...

Juju 安全漏洞

Juju is an open source application orchestration engine from Canonical Juju Open Source. Juju has a security vulnerability in 该漏洞源于任何有权访问默认网络命名空间的用户都可以连接到@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and performs operations normally reserved for the juju charm...