CVE-2024-34887

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request...

CVE-2024-34887: Insufficiently Protected Credentials

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request...

Bitrix24 security vulnerabilities

Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management. A security vulnerability exists in Bitrix24 version 23.300.100, which originates from a remote administrat...

Bitrix24 security vulnerabilities

Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management and CRM Customer Relationship Management. A security vulnerability exists in Bitrix24 version 23.300.100, which originates from a remote administrat...

CBL Mariner 2.0 Security Update: php (CVE-2024-8925)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8925 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form...

SmartAgent 1.1.0 Remote Code Execution

Exploit Title: SmartAgent v1.1.0 - Unauthenticated Remote Code Execution Date: 01-10-2024 Exploit Author: Alter Prime Vendor Homepage: https://smarts-srlcom.com/, https://smartagent.com Version: Build v1.1.0 Tested on: Kali Linux An unauthenticated user can access a php script called...

DrayTek Vigor Code Execution

The vulnerability of the web interface of DrayTek Vigor microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely or cause a service failure by sending a specially...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

CVE-2024-48733

A SQL injection vulnerability exists in the /SASStudio/sasexec/sessions/{sessionID}/sql endpoint of SAS Studio version 9.4 . A remote attacker can exploit this by sending a POST body request to execute arbitrary SQL commands. The vendor disputes this vulnerability, noting that SQL statement execu...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

LevelOne WBR-6012 Web Application buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-1997 LevelOne WBR-6012 Web Application buffer overflow vulnerability October 30, 2024 CVE Number CVE-2024-28052 SUMMARY The WBR-6012 is a wireless SOHO router. It is a low-cost device which functions as an internet gateway for homes and small offices while...

LevelOne WBR-6012 security vulnerability

The LevelOne WBR-6012 is a wireless router from LevelOne. A security vulnerability exists in the LevelOne WBR-6012 that stems from an HTTP POST request that can cause the device to crash and reboot by sending a URI containing 1454 characters or more...

K000148279: CUPS vulnerability CVE-2024-47850

Security Advisory Description CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. The request is meant to probe the new printer bu...

D-Link DIR-605L Router formSetWanL2TP XSS

The vulnerability of the formSetWanL2TP function /goform/formSetWanL2TP in the D-Link DIR-605L router software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

D-Link DIR-619L Router Data Compromise

The vulnerability of the formEasySetupWWConfig function /goform/formEasySetupWWConfig of the D-Link DIR-619L router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the curTime parameter. Exploiting this vulnerability allows an...

D-Link DIR-619L formLogDnsquery XSS

The vulnerability of the formLogDnsquery function /goform/formLogDnsquery of the D-Link DIR-619L router’s software lies in the fact that the operation’s output is written outside the buffer in memory when processing the curTime parameter. Exploiting this vulnerability allows an attacker to...

D-Link DIR-605L Router FormLogDnsquery Data Compromise

The vulnerability of the formLogDnsquery function /goform/formLogDnsquery in D-Link DIR-605L router microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality,...

D-Link DIR-605L Router FormSetEasy_Wizard Buffer Overflow

The vulnerability of the formSetEasyWizard function /goform/formSetEasyWizard in D-Link DIR-605L router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

D-Link DIR-619L Router formAdvFirewall Buffer Overflow

The vulnerability of the formAdvFirewall function /goform/formAdvFirewall of the D-Link DIR-619L router software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, a...

D-Link DIR-605L Router formSetWanNonLogin Data Compromise

The vulnerability of the formSetWanNonLogin function /goform/formSetWanNonLogin in the D-Link DIR-605L router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...