Yokogawa CENTUM

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.7 ATTENTION : Exploitable remotely/Low attack complexity Vendor : Yokogawa Equipment : CENTUM Vulnerability : Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

PT-2024-26407 · Westermo · L210-F2G Lynx +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly. There is no information provided about the estimated...

PT-2024-5694

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M20 Apache Tomcat versions 10.1.0-M1 through 10.1.24 Apache Tomcat versions 9.0.0-M1 through 9.0.89 Description The issue is related to the improper handling of exceptional conditions and...

PT-2024-10392

Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wi-Fi 5 Dual-Band router BR-6476AC version 1.06 Description The issue is related to command injection problems in /bin/goahead, which can be triggered through API endpoints such as "/goform/tracerouteDiagnosis",...

PT-2024-10391

Name of the Vulnerable Software and Affected Versions Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC version 1.06 Description The issue concerns the request /goform/fromSetDDNS not properly handling special characters in user-provided parameters, allowing an attacker with access to the web...

PT-2024-27776 · Unknown · Itsourcode Learning Management System

Name of the Vulnerable Software and Affected Versions: Itsourcecode Learning Management System Project In PHP With Source Code version 1.0 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the LessonID parameter in the processscore.php file...

PT-2024-37308 · Zkteco · Zkteco Zkbio Cvsecurity V5000

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity V5000 version 4.1.0 Description: A vulnerability was found in the Department Section component, where the manipulation of the Department Name argument leads to cross-site scripting. The attack can be launched remotely...

PT-2024-27704 · Unknown · Wvp Gb28181 Pro

Name of the Vulnerable Software and Affected Versions: Wvp GB28181 Pro version 2.0 Description: An access control issue allows authenticated attackers to escalate privileges to Administrator via a crafted POST request. Recommendations: For Wvp GB28181 Pro version 2.0, consider restricting access ...

PT-2024-7974

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the November 2024 security updates Description This is a spoofing issue in the New Technology LAN Manager NTLM protocol that allows attackers to steal NTLMv2 hashes with minimal user interaction. The...

Hitachi Energy UNEM

SUMMARY Hitachi Energy is aware of multiple internal reported vulnerabilities that affects the UNEM versions listed below. Please refer to the “Recommended Immediate Actions” for information about the remediation. 2. GENERAL MITIGATION FACTORS/WORKAROUNDS Recommended security practices and...

PT-2024-4062

Name of the Vulnerable Software and Affected Versions: Microsoft Outlook versions prior to the fixed version Description: A critical zero-click remote code execution vulnerability has been discovered in Microsoft Outlook. This vulnerability allows attackers to execute arbitrary code by sending a...

PT-2024-27107 · Totolink · Totolink Ac1200 Wireless Dual Band Gigabit Router

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware version A3100R V4.1.2cu.5247 B20211129 Description: The issue arises from the lack of input validation in the setNoticeCfg function, specifically with the NoticeUrl variable. This...

Update: CVE-2024-4577 quickly weaponized to distribute “TellYouThePass” Ransomware

Introduction Recently, Imperva Threat Research reported on attacker activity leveraging the new PHP vulnerability, CVE-2024-4577. From as early as June 8th, we have detected attacker activity leveraging this vulnerability to deliver malware, which we have now identified to be a part of the...

PT-2024-5560

Name of the Vulnerable Software and Affected Versions ws versions prior to 8.17.1 ws versions prior to 7.5.10 ws versions prior to 6.2.3 ws versions prior to 5.2.4 Description The issue is related to errors in handling request headers in the ws library for Node.js, specifically when the number of...

PT-2024-25509 · Pexip · Pexip Infinity

Name of the Vulnerable Software and Affected Versions: Pexip Infinity versions prior to 34.1 Description: The issue concerns improper access control, allowing individuals in a waiting room to view the conference roster list and perform certain actions before being admitted to the meeting...

PT-2024-27049

Name of the Vulnerable Software and Affected Versions: nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier Description: The issue is related to a Deserialization vulnerability, which can result in code execution. This can be achieved via the "/admin/extensions/download.php...

PT-2024-4387

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.24 and 2.7.7 Description The issue is related to the composer install command running inside a git/hg repository with specially crafted branch names, which can lead to command injection. This requires cloning...

PT-2024-20: Unauth Time-Based SQL Injection in Pandora FMS

The vulnerability was identified in Pandora FMS versions 700 to 776. Due to insufficient sanitization of the authorization header, Time-Based SQL Injection vulnerability may be exploited. The discovered vulnerability can be exploited by an attacker to access sensitive data. The vulnerability does...

New PHP Vulnerability Exposes Windows Servers to Remote Code Execution

Details have emerged about a new critical security flaw impacting PHP that could be exploited to achieve remote code execution under certain circumstances. The vulnerability, tracked as CVE-2024-4577, has been described as a CGI argument injection vulnerability affecting all versions of PHP...

PT-2024-24320 · Samsung · Exynos 2200 +2

Name of the Vulnerable Software and Affected Versions: Samsung Mobile Processor Exynos versions 2200, 1480, 2400 Description: An issue was discovered in Samsung Mobile Processor Exynos, where it lacks a check for the validation of native handles, which can result in code execution. Recommendation...