CVE-2024-1618

Affected software: Faronics Deep Freeze Server Standard, version ≤ 8.30.020.4627. Vulnerable component: DFServ.exe (service). Root cause: Unquoted item / search path vulnerability that lets a malicious file with the same name be loaded if placed in a higher-priority directory. Impact: Local attac...

CVE-2024-2394

SourceCodester Employee Management System 1.0 contains a vulnerability in the /Admin/add-admin.php file where manipulating the avatar parameter allows unrestricted file uploads. This could enable remote exploitation and is described as a critical issue in multiple sources (NVD, Red Hat, CVE recor...

Stack overflow

Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the entrys parameter fromAddressNat function...

Stack overflow

Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function...

CVE-2024-2049

Summary: CVE-2024-2049 is a SSRF vulnerability in Citrix SD-WAN Standard/Premium Editions (11.4.0–11.4.4.46). The issue allows an attacker to disclose limited information from the appliance via access to the management IP. Affected products/versions: Citrix SD-WAN Standard/Premium Editions on or ...

Design/Logic Flaw

A vulnerability has been identified in Cerberus PRO EN Engineering Tool All versions, Cerberus PRO EN Fire Panel FC72x All versions IP8 SR4, Cerberus PRO EN X200 Cloud Distribution All versions V4.3.5618, Cerberus PRO EN X300 Cloud Distribution All versions V4.3.5617, Sinteso FS20 EN Engineering...

Design/Logic Flaw

A vulnerability has been identified in Siveillance Control All versions = V2.8 V3.1.1. The affected product does not properly check the list of access groups that are assigned to an individual user. This could enable a locally logged on user to gain write privileges for objects where they only ha...

Design/Logic Flaw

A vulnerability has been identified in Cerberus PRO EN Engineering Tool All versions, Cerberus PRO EN Fire Panel FC72x All versions IP8 SR4, Cerberus PRO EN X200 Cloud Distribution All versions V4.3.5618, Cerberus PRO EN X300 Cloud Distribution All versions V4.3.5617, Sinteso FS20 EN Engineering...

Design/Logic Flaw

A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC 7KM3120-0BA01-1DA0 All versions = V3.2.3 = V3.2.3 = V3.2.3 = V3.2.3 V3.3.0 only when manufactured between LQN231003... and LQN231215... with LQNYYMMDD.... The read out protection of the internal flash of affected devices was not...

Code injection

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to resources and potentially lead to code execution...

CVE-2022-32257

Siemens SINEMA Remote Connect Server (all versions before V3.2) is affected by an improper access-control vulnerability in the web service endpoints, enabling unauthorized access and potentially remote code execution. Affected product: SINEMA Remote Connect Server; affected versions: prior to V3....

CVE-2024-2391

Summary: CVE-2024-2391 affects EVE-NG 5.0.1-13, specifically the Lab Handler component, where improper protection of the web page structure enables cross-site scripting. The issue can be exploited remotely, and public exploits/mentions exist (VDB-256442). Root cause: manipulation of an unknown La...

CVE-2024-27907

The CVE affects Simcenter Femap prior to V2306.0000, where parsing a Catia MODEL file can trigger an out-of-bounds write past an allocated buffer, enabling code execution in the affected process. Root cause is a memory/buffer handling issue during Catia MODEL file parsing. Public references corro...

CVE-2024-22045

CVE-2024-22045 concerns Siemens SINEMA Remote Connect Client. Affected: all versions prior to V3.1 SP1. Issue: insertion of sensitive information into files/directories that are externally accessible and also exposed via the product’s web interface, impacting confidentiality. Public documents con...

CVE-2024-22044

The CVE-2024-22044 entry concerns Siemens SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75, all versions). The issue is an unused and unstable HTTP service exposed on port 80/tcp over the Modbus‑TCP Ethernet, which an attacker on the same Modbus network can trigger to cause a denial-of-s...

CVE-2024-22041

CVE-2024-22041 pertains to the network communication library in Siemens Cerberus PRO EN and Sinteso/Sinteso Mobile/product ecosystems, which improperly handles memory buffers when parsing X.509 certificates. This leads to an unauthenticated remote attacker potentially crashing the affected networ...

CVE-2024-22040

Siemens CVE-2024-22040 involves a buffer overread in the network communication library due to insufficient validation of HMAC values. The flaw can allow an unauthenticated remote attacker to crash the affected network service. Affected products span Cerberus PRO EN Engineering Tool, Cerberus PRO ...

CVE-2024-22039

CVE-2024-22039 is a critical network-exposed vulnerability in Siemens Cerberus PRO EN/Sinteso EN and Desigo Fire Safety UL/FS products, caused by a stack-based buffer overflow in the network communication library due to unchecked lengths of certain X.509 certificate attributes. Impact: unauthenti...

CVE-2024-21483

Siemens CVE-2024-21483 affects SENTRON 7KM PAC3x20 devices (PAC3120/3220, AC/DC and DC variants) with firmware versions around V3.2.3–before V3.3.0. The root cause is improper read-out protection of internal flash at end of manufacturing, enabling a physically proximate attacker to read data from...

CVE-2023-45793

CVE-2023-45793 : Affected product is Siemens Siveillance Control (versions 2.8 up to 3.1.1). The issue is an authorization check failure related to the list of access groups assigned to a user, allowing a locally logged-on user to gain write privileges to objects they should only read. The vulner...