CVE-2024-35339

Tenda FH1206 V1.2.0.88155 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac...

CVE-2024-35344

Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800NN2, YMF50B, YM800SV2, YM500L8, and YM200E10...

CVE-2024-35342

Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, LED lighting, NTP, motion detection, etc. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280,...

Alvaria Unified IP Unified Director 安全漏洞

Alvaria Unified IP Unified Director is a multichannel unified communications platform from Alvaria, Inc. that is primarily used for contact center management and customer interaction management. A security vulnerability exists in Alvaria Unified IP Unified Director prior to version 7.4 SP2, which...

CVE-2024-35343

Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L,...

CVE-2024-35341

Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFile.ini or /config.xml URIs. This configuration file contains usernames and encrypted passwords encrypted with a hardcoded key common to all devices. This...

CVE-2024-12013

A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform...

CVE-2024-12012

A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the password as well as the session tokens are included as part of the URL and therefore exposed to information leakage...

CVE-2024-12011

A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid...

CVE-2024-12013

The CVE-2024-12013 entry describes a vulnerability in Nozomi Networks TCP/IP Gateway (firmware 12h, device series 130.8005) where an FTP server is protected by default/easily guessable admin credentials. The underlying issue is CWE-1392 Use of Default Credentials. A remote attacker that can reach...

CVE-2024-12013

A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform...

CVE-2024-12013

A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could gain access and perform...

CVE-2024-12012

A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the password as well as the session tokens are included as part of the URL and therefore exposed to information leakage...

CVE-2024-12012

CVE-2024-12012 affects Nozomi Networks TCP/IP Gateway (firmware 12h). The flaw stems from CWE-598: GET requests carrying sensitive query strings leak the SHA-1 password hash and session tokens via the URL, enabling information leakage and potential bypass of authentication (pass-the-hash). Affect...

CVE-2024-12011

A CWE-126 “Buffer Over-read” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The information disclosure can be triggered by leveraging a memory leak affecting the web server. A remote unauthenticated attacker can exploit this vulnerability in order to leak valid...

CVE-2024-12011

CVE-2024-12011 affects Nozomi Networks/Zettler 130.8005 TCP/IP Gateway (firmware 12h). A CWE-126 buffer over-read due to a memory leak in the web server can trigger remote information disclosure, allowing a remote unauthenticated attacker to leak authentication tokens from process memory and bypa...

Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: Revert setting SELinux context for minion service bsc1233667 Removed System V init support Fix the condition of alternatives for Tumbleweed and Leap 16 Build all python bindings for all flavors Make minion reconnecting on changing master IP bsc1228182...

TP-LINK TL-WR841ND 安全漏洞

TP-LINK TL-WR841ND is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-Link TL-WR841ND V11 version, which originates from the gw parameter of /userRpm/WanDynamicIpV6CfgRpm.htm contains a buffer overflow vulnerability...

TP-LINK TL-WR841ND 安全漏洞

TP-LINK TL-WR841ND is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK TL-WR841ND V11 version, which originates from the ip parameter of /userRpm/WanStaticIpV6CfgRpm.htm contains a buffer overflow vulnerability...

CVE-2024-37600

CVE-2024-37600 concerns Mercedes-Benz NTG (MBUX) head units (6 through 2021) with a stack buffer overflow in the Service Broker service (MoCCA). Exploitation requires physical access to the head unit’s base-board Ethernet pins and a static IP on the internal network; an attacker can send crafted ...