i2soft CMS 2.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : i2soft CMS v2.0 Insecure Direct Object Reference Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...

Cacti security breach

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. A security vulnerability exists in Cacti versions prior to 1.2.6, which ste...

Vulnerabilities fixed in Aruba Networks ArubaOS and InstantOS

Aruba Networks has fixed vulnerabilities in ArubaOS and InstantOS. A malicious party can exploit the vulnerabilities to gain access to system data, or to execute arbitrary code execute arbitrary code with elevated privileges. Successful exploitation requires the malicious party to have access to...

CVE-2023-3638

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

PT-2023-5481 · Advantech · Eki-1522 +2

Name of the Vulnerable Software and Affected Versions: Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 Description: The issue is related to a Stored Cross-Site Scripting vulnerability. This vulnerability can be triggered by authenticated users in the device name field of the...

PT-2023-25900 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

Information disclosure

SSPanel-Uim 2023.3 does not restrict access to the /link/ interface which can lead to a leak of user information...

SSPanel UIM 安全漏洞

SSPanel UIM is a multi-purpose proxy service sales management system designed for the Shadowsocks / V2Ray / Trojan protocols by the individual developer Anankke. A security vulnerability exists in SSPanel UIM version 2023.3, which stems from not restricting access to the interface, leading to the...

Citrix ADC and Citrix Gateway Multiple Vulnerabilities (CTX477714)

The remote Citrix ADC or Citrix Gateway device is version 12.1 before 12.1-65.35, 12.1-FIPS before 12.1-55.296, 13.0 before 13.0-90.11 or 13.1 before 13.1-45.61. It is therefore affected by multiple vulnerabilities: - A cross-site scripting vulnerability affecting appliances configured as a Gatew...

Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...

PT-2023-19355 · WordPress · Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin

Name of the Vulnerable Software and Affected Versions: Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin versions = 2.5.3 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inje...

Design/Logic Flaw

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure via an invalid authentication attempt. This can afterwards be used to bypass the device's authentication and get access to the administrative interface...

PT-2023-18591 · Securepoint · Securepoint Utm

Name of the Vulnerable Software and Affected Versions: SecurePoint UTM versions prior to 12.2.5.1 Description: An issue was discovered in the firewall's endpoint at "/spcgi.cgi" that allows sessionid information disclosure via an invalid authentication attempt. This can be used to bypass the...

Siemens SCALANCE W1750D Cryptographic Issues (CVE-2017-13099)

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as ROBOT. This plugin only works with Tenable.ot...

PT-2023-2507 · Avg +1 · Avg Antivirus +1

Name of the Vulnerable Software and Affected Versions: Avast Antivirus versions prior to 22.11 AVG Antivirus versions prior to 22.11 Description: The issue is related to a NULL pointer dereference problem via the RPC-interface, which could allow an attacker to cause a denial of service. The...

SUSE CVE-2007-3099

usr/mgmtipc.c in iscsid in open-iscsi iscsi-initiator-utils before 2.0-865 checks the client's UID on the listening AFLOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service iscsid exit or iSCSI connection loss...

CVE-2022-3089

Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file...

CVE-2021-36225

Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation...

CVE-2020-18330

An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01hardware platform Gpn2.4P21-CWIFI-V0.05, allows attackers to gain access to the configuration interface...

CVE-2020-18330: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01hardware platform Gpn2.4P21-CWIFI-V0.05, allows attackers to gain access to the configuration interface...