CVE-2025-0542

CVE-2025-0542 affects G DATA Management Server. The issue is an incorrect assignment of privileges for temporary files in the update mechanism, enabling a local, unprivileged attacker to escalate privileges by placing a crafted ZIP archive in a globally writable directory, which is unpacked in th...

CVE-2025-0542: Incorrect Default Permissions

Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally...

The vulnerability of the Fortinet FortiClient Enterprise Management Server (EMS) and the FortiClient EMS Cloud cloud storage service lies in the lack of data cleaning measures at the management level. This allows attackers to execute arbitrary code.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS and the FortiClient EMS Cloud cloud storage service is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

File Upload Vulnerability in the Center Management Server System of Guangdong Paulan Electronics Co.

Guangzhou Paulun Electronic Co., Ltd. is a company mainly engaged in public broadcasting, campus broadcasting, conference system, paperless system, recording and broadcasting system, intelligent campus, stage lighting, LED big screen, landscape lighting and other projects. A file upload...

Logic Flaw Vulnerability in Center Management Server System of Guangdong Paulan Electronics Co.

Guangzhou Paulun Electronic Co., Ltd. is a company mainly engaged in public broadcasting, campus broadcasting, conference system, paperless system, recording and broadcasting system, intelligent campus, stage lighting, LED big screen, landscape lighting and other projects. Guangdong Paulan...

Command Execution Vulnerability in the Management Server of itC Center of Guangdong Paulan Electronics Company Limited (CNVD-2024-41827)

Ltd. is a high-tech enterprise integrating R&D, design, production, sales and service of audio-visual system overall solution products. There is a command execution vulnerability in the itC center management server of Guangdong Paulan Electronics Co., Ltd. that can be exploited by an attacker to...

Information leakage vulnerability in the management server of itC center of Guangdong Paulan Electronics Co.(CNVD-2024-41833)

Ltd. is a high-tech enterprise integrating R&D, design, production, sales and service of audio-visual system overall solution products. There is an information leakage vulnerability in the management server of itC Center of Guangdong Paulan Electronics Co., Ltd. which can be exploited by attacker...

Information leakage vulnerability in the management server of itC center of Guangdong Paulan Electronics Co.(CNVD-2024-41835)

Ltd. is a high-tech enterprise integrating R&D, design, production, sales and service of audio-visual system overall solution products. There is an information leakage vulnerability in the management server of itC Center of Guangdong Paulan Electronics Co., Ltd. which can be exploited by attacker...

Nuuo Central Management Server Authenticated Arbitrary File Download

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nuuo Central Management Server Authenticated Arbitrary File Download', 'Description' = %q The Nuuo Central Management Server allows an...

File Upload Vulnerability in the Management Server of itC Center of Guangdong Paulan Electronics Co.(CNVD-2024-38833)

Ltd. is a high-tech enterprise integrating R&D, design, production, sales and service of audio-visual system overall solution products. There is a file upload vulnerability in the management server of Guangdong Paulan Electronics Co. itC Center, which can be exploited by an attacker to gain contr...

Command Execution Vulnerability in the Management Server of itC Center of Guangdong Paulan Electronics Company Limited (CNVD-2024-41253)

Guangzhou Paulun Electronic Co., Ltd. is a company mainly engaged in public broadcasting, campus broadcasting, conference system, paperless system, recording and broadcasting system, intelligent campus, stage lighting, LED big screen, landscape lighting and other projects. There is a command...

CVE-2024-21550

SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central server for management of registered charge points. Attackers can inject arbitrary HTML and Javascript code via WebSockets leading to persistent Cross-Site...

Solar-Log 1000 安全漏洞

Solar-Log 1000 is a solar photovoltaic data logger from the German company Solar-Log. A security vulnerability exists in Solar-Log 1000 prior to version 2.8.2 Build 52, which stems from the presence of a False Privilege Modification vulnerability that could allow an attacker to gain administrativ...

Apache CloudStack 代码注入漏洞

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from a code injection vulnerability that...

GHSA-PVXJ-25M6-7VQR Rancher Privilege escalation vulnerability via malicious "Connection" header

A vulnerability was discovered in Rancher 2.0.0 through the aforementioned patched versions, where a malicious Rancher user could craft an API request directed at the proxy for the Kubernetes API of a managed cluster to gain access to information they do not have access to. This is done by passin...

FortiNet FortiClient EMS 7.2.2 / 7.0.10 SQL Injection / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FortiNet FortiClient Endpoint Management Server FCTID SQLi to RCE', 'Description' = %q An SQLi injection vulnerability exists in FortiNet...

CVE-2024-3387

A weak low bit strength device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle MitM attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker...

PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure

A weak low bit strength device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle MitM attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker...

PT-2024-2990

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Panorama affected versions not specified Description The issue is related to insufficiently robust data encryption. It allows a remote attacker to perform a man-in-the-middle attack, potentially gaining unauthorized access t...

CVE-2024-3387: Inadequate Encryption Strength

A weak low bit strength device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle MitM attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker...