CVE-2024-37186

An os command injection vulnerability exists in the adm.cgi setledonoff functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

H3C N12 V100R005 安全漏洞

The H3C N12 V100R005 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the H3C N12 V100R005 version, which stems from a lack of length validation in the 5G wireless network processing function, which could lead to an attacker crashing a remote target device or...

Microsoft Windows COM 安全漏洞

Microsoft Windows COM is a technology for the purpose of reusing software from Microsoft Corporation USA.COM is described as a platform-independent, decentralized, object-oriented system for creating interactive binary software components. A security vulnerability exists in Microsoft Windows COM...

PT-2025-2974 · Siemens · Siprotec 5 Compact 7Sx800 +16

Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD84 CP300 versions prior to V9.80 SIPROTEC 5 6MD85 CP300 versions 7.80 through 9.79 SIPROTEC 5 6MD86 CP300 versions 7.80 through 9.79 SIPROTEC 5 6MD89 CP300 versions 7.80 through 9.89 SIPROTEC 5 6MU85 CP300 versions 7.80 through...

PT-2025-4194 · Microsoft · Com +1

Name of the Vulnerable Software and Affected Versions: Microsoft COM for Windows affected versions not specified Description: An elevation-of-privilege issue affects the system, allowing attackers to elevate their privileges. Recommendations: At the moment, there is no information about a newer...

BIT-NODE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

BIT-NODE-MIN-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

The vulnerability of the Suricata intrusion detection and prevention system’s TCP protocol allows attackers to compromise the integrity of the protected information.

The vulnerability of the Suricata intrusion detection and prevention system’s TCP protocol implementation is related to the incomplete model of the characteristics of the destination node. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected...

CVE-2024-37372

A flaw was found in Node.js. The Permission Model assumes that any UNC path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-43663

There are many buffer overflow vulnerabilities present in several CGI binaries of the charging station.This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High – Given the prevalence of these buffer overflows, and the clear error message of the web...

CVE-2024-43653

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – The binary does not seem to be used by the web interface,...

CVE-2024-43660 Arbitrary file download using <redacted>.sh

The CGI script .sh can be used to download any file on the filesystem. This issue affects Iocharger firmware for AC model chargers beforeversion 24120701. Likelihood: High, but credentials required. Impact: Critical – The script can be used to download any file on the filesystem, including...

CVE-2024-43652

CVE-2024-43652 affects Iocharger firmware for AC-model chargers older than 24120701. The issue is an Improper Neutralization of Special Elements used in a Command (Command Injection) that allows OS Command Injection as root, giving an attacker complete control over the charging station (files/ser...

CVE-2024-43657

Summary of CVE-2024-43657 (Iocharger firmware) : Affects AC model Iocharger firmware before 24120701. The issue is an improper neutralization of special elements in a firmware file, enabling OS command injection as root via the processing of a firmware upload. Attack requires a low-privileged acc...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

ALPINE-CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-37372

The CVE-2024-37372 entry concerns Node.js and the experimental permission model. The root cause is a faulty assumption in UNC path handling: the model treats paths starting with two backslashes as having a four-character prefix that can be ignored, which is not universally true. This leads to vul...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...