CVE-2024-52940

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID...

CVE-2024-52940

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID...

Information Leakage

symfony/http-client is vulnerable to IP/port enumeration. The vulnerability is due to improper handling of IP filtering in the NoPrivateNetworkHttpClient, which fails to block certain IPs early enough during host resolution, allowing an attacker to enumerate IP addresses and ports, potentially...

CVE-2024-52940

CVE-2024-52940 describes an exposure risk in AnyDesk up to version 8.1.0 on Windows when the Allow Direct Connections option is enabled. The underlying issue is that public IP addresses are exposed in network traffic, and an attacker who knows the victim’s AnyDesk ID can exploit this behavior. Pu...

AnyDesk 安全漏洞

AnyDesk is a remote desktop connection software from AnyDesk Germany. A security vulnerability exists in AnyDesk 8.1.0 and earlier versions, which stems from the ability to inadvertently expose public IP addresses in network traffic...

CVE-2024-52940

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID...

CVE-2024-52940

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID...

CVE-2024-51495 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwriteip" parameter when editing a device. This vulnerability results i...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the overwriteip parameter in dev-overview-data.inc.php. PoC Pass in an overwriteip...

CVE-2024-0787

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...

CVE-2024-0787 Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...

CVE-2024-0787

CVE-2024-0787 affects phpIPAM 1.5.1: an incorrect check in get_user_ip() (class.Common.php, lines 1044–1045) uses X-Forwarded-For instead of REMOTE_ADDR, allowing bypass of IP block and brute-forcing user passwords (including admin). The issue is fixed in version 1.7.0; upgrade to 1.7.0+ to remed...

CVE-2024-0787 Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'getuserip' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the...

PT-2024-34659 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the overwrite ip parameter when editing a device. Th...

PT-2024-15819 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpIPAM version 1.5.1 Description: The issue allows an attacker to bypass the IP block mechanism, enabling brute force attacks on user accounts, including the admin account, by utilizing the 'X-Forwarded-For' header. This is due to the get us...

Cisco IP Phones Information Disclosure (cisco-sa-phone-infodisc-sbyqQVbG)

According to its self-reported version, Cisco 7800, 8800, and 9800 Series Phones Information Disclosure is affected by a vulnerability. - A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated,...

Siemens Energy Omnivise T3000 8.2 SP3 Privilege Escalation / File Download

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Siemens Energy Omnivise T3000 vulnerable version: =8.2 SP3 fixed version: see solution section CVE number: CVE-2024-38876, CVE-2024-3887...

The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper allows a attacker to bypass the authentication process.

The vulnerability of the IPAuthenticationProvider component of the centralized service for managing configuration information, naming, distributed synchronization, and providing group services via Apache ZooKeeper is related to the ability to bypass authentication through phising techniques...

PT-2024-10022

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.19.325, 6.11.11, and 6.12.2 Description The issue is related to a missing range check in the bitmap ip uadt function within the Linux kernel's netfilter module. This occurs when tbIPSET ATTR IP TO is not presen...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 9800, 7800, 8800, and 8875 allows a perpetrator to access confidential information.

The vulnerability of the web interface of Microprogramming Software for Cisco IP Phones 9800, 7800, 8800, and 8875 lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information from a remote location...