CVE-2024-47464 Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files

An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to a remote...

CVE-2024-47464 Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files

An authenticated Path Traversal vulnerability exists in Instant AOS-8 and AOS-10. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to a remote...

The vulnerability of the password-changing function of the Cisco Firepower Management Center (FMC) software interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the password-changing function in the Cisco Firepower Management Center FMC software for network administration involves errors in handling requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

SAP Solution Manager Remote Unauthorized OS Commands Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Solution Manager remote unauthorized OS commands execution', 'License' = MSFLICENSE, 'Author' = 'Yvan Genuer', @1ggy The researcher who...

The vulnerability of the Service Gateway component of the Oracle BI Publisher software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Service Gateway component of the Oracle BI Publisher software for report generation is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)

By default, SANnav OVA is shipped with root user login enabled. Product Affected All Brocade OVA SANnav versions Mitigation Starting with SANnav OVA version v2.3.0 and later versions, a root account is not required for installation and management of the SANnav. If an administrator is uncomfortabl...

The vulnerability of the Telnet service of the microprogramming-based router AdTran NetVanta 3120 allows a intruder to gain unauthorized access to the device.

The vulnerability of the Telnet service provided by the microprogramming-based router software AdTran NetVanta 3120 is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the device...

PT-2024-21375 · Ruijie · Ruijie Rg-Nbs2009G-P Rgos

Name of the Vulnerable Software and Affected Versions: Ruijie RG-NBS2009G-P versions up to 20240305 Description: A critical vulnerability exists in Ruijie RG-NBS2009G-P. The issue affects an unknown function within the /system/passwdManage.htm file of the Password Handler component, leading to...

The vulnerability of the MongoDB database management system is related to errors in the TLS certificate validation process, which allows a perpetrator to establish unauthorized connections to the MongoDB server.

The vulnerability of the MongoDB database management system is related to errors in the TLS certificate validation process. Exploiting this vulnerability allows an attacker to establish unauthorized connections to the MongoDB server remotely...

Design/Logic Flaw

Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.getldapinfo in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity,...

PT-2024-1050 · Microsoft · Message Queuing +1

Name of the Vulnerable Software and Affected Versions: Microsoft Message Queuing affected versions not specified Description: The vulnerability is related to insufficient protection of service data in Microsoft Message Queuing, which can allow a remote attacker to gain unauthorized access to...

Siemens SIMATIC

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

The vulnerability of the web interface of Technicolor TG670 router software, related to the possibility of using strictly encrypted login credentials, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web interface of the microprogramming software for the Technicolor TG670 lies in the possibility of using hard-coded credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB...

PT-2023-6861 · Google · Google Calendar

Name of the Vulnerable Software and Affected Versions: Google Календарь Google Calendar affected versions not specified Description: The issue is related to insufficient access control in the Google Calendar service. It may allow a remote attacker to gain unauthorized access to the vulnerable...

The vulnerability of ScrutisWeb banknote monitoring software lies in a processing error related to user-controlled authentication keys, which allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of ScrutisWeb banknote monitoring software relates to an error in the processing of authentication keys controlled by users. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Oracle Notification Server component of the Oracle Database Server database management system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Oracle Notification Server component of the Oracle Database Server database management system is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the insufficient protection of operational data, allowing an attacker to gain unauthorized access to protected information.

The vulnerability of the Microsoft Dynamics 365 resource planning software is related to insufficient protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2023-5959 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 affected versions not specified Description: The issue is related to insufficient protection of service data in Microsoft Dynamics 365, which can be exploited by a remote attacker to gain unauthorized access to protecte...

CVE-2023-39252

Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by performing MitM attacks and let attackers obtain sensitive information...