432 matches found
CVE-2019-10008
CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...
CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...
CVE-2026-84398
CareCam CM2507 IP cameras are vulnerable to unauthorized access due to an empty password accepted for a privileged account exposed through the ONVIF management service. The root cause is an empty password stored in a configuration file, allowing an attacker with network access to reach privileged...
EcoStruxure IT Data Center Expert < 9.1.2 Multiple Vulnerabilities (SEVD-2026-251-01)
The version of EcoStruxure IT Data Center Expert installed on the remote host is prior to 9.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SEVD-2026-251-01 advisory. - CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized...
CVE-2026-8044
CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...
CVE-2026-19233
CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...
CVE-2026-19233
CVE-2026-19233 is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability affecting a Schneider Electric product (identified by CNA [email protected] and advisory SEVD-2026-251-01 ). An attacker with a privileged account can send crafted, unvalidated parameters to a server endpoint, potent...
EUVD-2026-75105
CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...
CVE-2026-19233
CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...
CVE-2026-8044
CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...
EUVD-2026-75097
CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...
CVE-2026-8044
CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...
CVE-2026-8044
CVE-2026-8044 is a CWE-88 (Argument Injection) vulnerability in Schneider Electric software, enabling remote code execution when a privileged attacker supplies malicious arguments as backup configuration parameters . The CVSS 4.0 score is 8.6 (HIGH) , with low attack complexity and no user intera...
PT-2026-89102
CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...
PT-2026-89083
CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...
EUVD-2026-66762
A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...
CVE-2026-58070
A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...
CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
CVE-2026-71479
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...