eSpeak NG Security Vulnerability

eSpeak NG is an open source software text-to-speech synthesizer from eSpeak NG Open Source. A security vulnerability exists in eSpeak NG version 1.52-dev, which is caused by a buffer overflow in the SetUpPhonemeTable method of the synthdata.c file...

PaperCut MF and PaperCut NG Security Vulnerabilities

PaperCut MF and PaperCut NG are both products of PaperCut Australia.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control software.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control...

CVE-2023-46964

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

Cross site scripting

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

CVE-2023-46964

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

CVE-2023-46964: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering...

CVE-2023-46964

CVE-2023-46964 affects Hillstone Next Generation Firewall SG-6000-e3960 (v5.5). The issue is a Cross Site Scripting (XSS) vulnerability due to using front-end filtering instead of back-end filtering, enabling a remote attacker to execute arbitrary code. Impact is described as arbitrary code execu...

New Secaucus Point of Presence Increases Resilience for Financial Services

We are thrilled to announce the opening of a new cutting-edge Point of Presence PoP in Secaucus, New Jersey, which adds resilience to our network infrastructure located in the Northeastern United States region. This PoP represents the first build using next generation technology designed to...

The vulnerability of the “static-content-files” component of the PaperCut MF and PaperCut NG software management printing infrastructure allows a intruder to gain unauthorized access to protected information.

The vulnerability of the “static-content-files” component in the PaperCut MF and PaperCut NG software for managing print infrastructure is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker operating remotely to gain...

PaperCut MF and PaperCut NG Path Traversal Vulnerabilities

PaperCut MF and PaperCut NG are both products of PaperCut Australia.PaperCut MF is a multifunctional printer control software.PaperCut NG is a next-generation printer control software.PaperCut NG is a next-generation printer control software.PaperCut MF is a multifunctional printer control...

Sangfor Next-Gen Application Firewall Security Vulnerabilities

Sangfor Next-Gen Application Firewall Sangfor NGAF is an application firewall from China-based Sangfor. A security vulnerability exists in Sangfor Next-Gen Application Firewall NGAF version 8.0.17, which allows an authenticated attacker to read arbitrary system files using the svpnhtml/loadfile.p...

Proactively Prevent Breaches with Expanded Endpoint Protection in Rapid7 MDR

Working with thousands of security and risk professionals across the globe, we know that complexity is the top challenge SOCs are facing today. As the attack surface rapidly expands, security teams need more effective ways to keep pace with digital transformation and get out of the cycle of...

Contiki-NG Buffer Error Vulnerability

Contiki-NG is an open source cross-platform operating system for next-generation IoT Internet of Things devices. Contiki-NG 4.9 and earlier versions suffer from a buffer error vulnerability that stems from allowing an attacker to inject TCP packets resulting in out-of-bounds buffer reads...

CVE-2023-39424

A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content such as a web shell component to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but c...

CVE-2023-39420

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the...

CVE-2023-39422

The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless...

CVE-2023-39420

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the...

CVE-2023-39424

A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content such as a web shell component to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but c...

Code injection

The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless...

CVE-2023-39424 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dll

A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content such as a web shell component to the SQL database and execute it with SYSTEM privileges. This vulnerability requires authentication to be exploited but c...