CVE-2023-43849

Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This may result in DoS or remote code execution...

CVE-2023-43848

Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as if they were the administrator via HTTP POST request...

CVE-2023-30305

The CVE-2023-30305 entry concerns Linksys E5600 routers. Affected component: the router’s TCP session handling, where an issue allows an attacker to hijack TCP sessions, potentially leading to a denial of service. Public details across connected records confirm the core impact but do not specify ...

CVE-2023-30311

The CVE-2023-30311 issue affects H3C Magic R365 and H3C Magic R100 routers. A TCP session hijacking vulnerability could allow an attacker to cause a denial of service. Root cause details are not provided in the documents. Exploitation status is not described; no in-wild exploit information is inc...

CVE-2024-33450

Finereport v8.0 is affected by an SQL injection vulnerability that enables a remote attacker to obtain sensitive information. The issue stems from insecure SQL handling in Finereport 8.0. No exploit details are provided in the documents. Remediation is to update to a version that includes a fix, ...

CVE-2024-36107

MinIO (MinIO object storage) contains a information-disclosure vulnerability (CVE-2024-36107) where anonymous GET requests using If-Modified-Since/If-Unmodified-Since can reveal object existence and metadata (Last-Modified, Etag, x-amz-version-id, Expires, Cache-Control) without proper validation...

CVE-2024-5434

CVE-2024-5434 affects Campbell Scientific CSI Web Server (and RTMC Pro in affected scope). The vulnerability concerns storing web authentication credentials in a file with a specific name where passwords are weakly encoded. If an attacker gains access to that file, passwords could be decoded and ...

CVE-2024-36109

CVE-2024-36109 affects CoCalc. In affected versions, the markdown parser allows embedded HTML [removed] tags to be executed when published, enabling cross-site scripting (XSS). Root cause: markdown rendering flaw that permits script execution. Impact stated as high confidentiality and integrity r...

CVE-2024-5433

The CVE-2024-5433 vulnerability affects Campbell Scientific CSI Web Server (and RTMC Pro) and is caused by a path traversal flaw in a command that returns the most recent file matching a given expression. Versions 1.6 and earlier of the CSI Web Server (and RTMC Pro 5.x/4.x) are affected. An attac...

CVE-2024-36110

CVE-2024-36110 affects the open-source web UI for Ansible named ansibleguy-webui. The vulnerability arises from multiple HTML injection points in forms for versions earlier than 0.0.21, with injected elements being returned to users and rendered by browsers after job actions. The issue has been a...

CVE-2024-24919

CVE-2024-24919 is a zero-day-like vulnerability in Check Point Security Gateways (Remote Access VPN/Mobile Access blades) allowing unauthenticated remote readers to fetch arbitrary files via path traversal (e.g., aCSHELL/../../../../../../../etc/shadow). Public PoCs and in-the-wild mentions exist...

CVE-2023-43850

CVE-2023-43850 affects ATEN PE6208 web interface (versions 2.3.228 and 2.4.232). The issue is improper input validation in the user management function, allowing remote authenticated users to trigger a partial denial of service via HTTP POST requests. The connected documents corroborate the affec...

CVE-2023-43849

CVE-2023-43849 concerns Aten PE6208 devices, where the web interface firmware upgrade function has incorrect access control. Affected firmware versions are 2.3.228 and 2.4.232. Remote authenticated users can submit a firmware image via HTTP POST, with potential outcomes including DoS or remote co...

CVE-2023-43848

CVE-2023-43848 affects Aten PE6208 firewall management in the web interface. The issue is incorrect access control that lets remote authenticated users alter local firewall settings as if they were an administrator via HTTP POST. Affected versions include 2.3.228 and 2.4.232. Documented impact is...

CVE-2023-43847

CVE-2023-43847 (Aten PE6208) affects PE6208 devices, versions 2.3.228 through 2.4.232. The root cause is incorrect access control in the web interface’s outlet control function, enabling remote authenticated users to control all outlets as if they were administrators via HTTP POST requests. Publi...

CVE-2023-43846

The CVE-2023-43846 issue affects Aten PE6208 web interface logs management. Affected versions: 2.3.228 through 2.4.232. Description from multiple sources indicates improper access control in the web UI logs management function allows remote attackers to retrieve device logs via HTTP GET, exposing...

CVE-2023-43845

CVE-2023-43845 affects Aten PE6208 devices, specifically versions 2.3.228 and 2.4.232, where default credentials for the privileged telnet account allow login with administrator privileges if unchanged after first login. The root cause is default credentials not being enforced to be changed, enab...

CVE-2023-43844

CVE-2023-43844 affects Aten PE6208 devices (versions 2.3.228 and 2.4.232). The issue is default credentials on the privileged web interface; users are not forced to change them after first login, enabling an attacker with access to log in and gain administrator privileges. The risk is supported b...

CVE-2023-43843

CVE-2023-43843 affects Aten PE6208 web interface: improper access control in the account management function on versions 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator passwords via HTTP GET. Impact is passwords exposed; CVSS 3.1 base score 7.3 (HIGH) with ne...

CVE-2023-43842

CVE-2023-43842 concerns Aten PE6208 web interface: the account-management function has incorrect access control, allowing remote authenticated users to alter user and administrator credentials via an HTTP POST request. Affected versions are 2.3.228 through 2.4.232. The root cause is improper acce...