CVE-2022-24629

CVE-2022-24629 affects AudioCodes Device Manager Express (versions up to 7.8.20002.47752). The issue is a directory-traversal in the dir parameter of BrowseFiles.php file upload, enabling remote code execution by uploading a .php file to WebAdmin/admin/AudioCodes_files/ajax/. Public sources docum...

PT-2023-12763 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue is related to stored XSS via the desc parameter in the "ajaxTenants.php" endpoint. Recommendations: For AudioCodes Device Manager Express versions throu...

CVE-2022-24628

AudioCodes Device Manager Express (up to version 7.8.20002.47752) is affected by an authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php. The CVE is CVE-2022-24628. Impacted component: IPPhoneFirmwareEdit.php; attacker must be authenticated; vulnerability enables potentially...

CVE-2022-24631

AudioCodes Device Manager Express (versions up to 7.8.20002.47752) contains a stored XSS vulnerability in the ajaxTenants.php desc parameter. This is documented across multiple sources (CVE-2022-24631 and member metadata) as a cross-site scripting issue in that endpoint. PT-2023-12763 notes recom...

CVE-2022-24628

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php...

PT-2023-12764 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue concerns directory traversal during file download. This occurs via the view parameter in the "BrowseFiles.php" endpoint. Recommendations: For versions...

PT-2023-12761 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: An issue allows remote code execution via directory traversal in the dir parameter of the file upload functionality of "BrowseFiles.php". An attacker can upload a...

CVE-2022-24632

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter...

CVE-2022-24627

Summary: CVE-2022-24627 affects AudioCodes Device Manager Express (versions up to 7.8.20002.47752). It is an unauthenticated SQL injection in the parameter p of the login form process_login.php. The underlying cause is improper input handling, enabling attackers to bypass authentication and poten...

NetScaler/Gateway VPX GUI shows FREEMIUM.

NetScaler VPX GUI shows as freemium with limited Express features. As shown in below image...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS bas...

Screen SFT DAB 600/C - Unauthenticated Information Disclosure (userManager.cgx)

Exploit Title: Screen SFT DAB 600/C - Unauthenticated Information Disclosure userManager.cgx Exploit Author: LiquidWorm Vendor: DB Elettronica Telecomunicazioni SpA Product web page: https://www.screen.it | https://www.dbbroadcast.com...

U.S. Dept Of Defense: Endpoint Redirects to Admin Page and Provides Admin role

The web application running on Oracle Apex Express platform was found to have an endpoint that redirected users to the admin page and provided them with admin privileges, bypassing access control restrictions. The vulnerability was discovered by navigating to a specific page within the applicatio...

AZL-26736 CVE-2023-2700 affecting package libvirt for versions less than 7.10.0-5

A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's gautoptr cleanup...

express-scripts.com Cross Site Scripting vulnerability OBB-3334011

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

alsieexpress.dk Cross Site Scripting vulnerability OBB-3313608

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)

An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP eXpress Data Path subsystem. This flaw allows a local user to crash the system...

Striker - A Command And Control (C2)

Striker is a simple Command and Control C2 program. Disclaimer This project is under active development. Most of the features are experimental, with more to come. Expect breaking changes. Features A Agents Native agents for linux and windows hosts. Self-contained, minimal python agent should you...

WordPress Optima Express + MarketBoost IDX Plugin Plugin <= 7.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Optima Express + MarketBoost IDX Plugin Type Plugin Vulnerable versions = 7.3.0 Fixed in 7.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30749 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f3093396364d Credits...

express: "qs" prototype poisoning causes the hang of the node process

A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a proto or constructor payload, a remote attacker can cause a...