CVE-2020-3538 Cisco Data Center Network Manager Path Traversal Vulnerability

A vulnerability in a certain REST API endpoint of Cisco Data Center Network Manager DCNM Software could allow an authenticated, remote attacker to perform a path traversal attack on an affected device. The vulnerability is due to insufficient path restriction enforcement. An attacker could exploi...

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

CVE-2024-37155 OpenCTI May Bypass Introspection Restriction

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. This issue is applicable to PAN-OS 10.1, PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS...

Cross-Site Scripting (XSS)

studio-42/elfinder is vulnerable to persistent Cross-site Scripting XSS. The vulnerability is due to a filename restriction bypass, allowing attackers to inject malicious scripts...

PT-2024-35257 · Unknown · Reconstruction

Name of the Vulnerable Software and Affected Versions: ReConstruction versions 1.4.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions...

PT-2024-30574 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue allows an unauthenticated user to use an application endpoint to check if an email address corresponds to a valid GLPI user. Recommendations: For versions 0.80 through 10.0.16, update ...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

PT-2025-13827 · NetGear · Netgear Wnr854T

Name of the Vulnerable Software and Affected Versions: Netgear WNR854T version 1.5.2 Description: The issue allows an attacker to send a specially crafted request to "post.cgi", updating the wan hostname parameter in nvram, which can lead to command injection and force a reboot. Recommendations:...

PT-2025-13825 · NetGear · Netgear Wnr854T

Name of the Vulnerable Software and Affected Versions: Netgear WNR854T version 1.5.2 Description: The issue concerns a stack-based buffer overflow in the M-SEARCH Host header of the UPNP service, located at /usr/sbin/upnp. Recommendations: For Netgear WNR854T version 1.5.2, consider disabling the...

GHSA-Q297-5FF8-HC92 FitNesse Path Traversal

Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specif...

PT-2024-9633 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

PT-2024-16351

Name of the Vulnerable Software and Affected Versions Dataprom Informatics Personnel Attendance Control Systems PACS / Access Control Security Systems ACSS versions prior to 2024 Description The issue is related to an Origin Validation Error, which allows traffic injection. This affects the...

PT-2024-16490 · WordPress · Postx

Name of the Vulnerable Software and Affected Versions: PostX plugin for WordPress versions up to, and including, 4.1.16 Description: The issue is related to a missing capability check on the install required plugin callback function, allowing authenticated attackers with Subscriber-level access a...

PT-2024-16852 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical issue affects some unknown functionality of the file /admin/ad list.php?action=pass of the component Keyword Filtering. The manipulation of the keyword argument leads to SQL injection. The attack may...

PT-2024-34484 · Unknown · Flightpath

Name of the Vulnerable Software and Affected Versions: FlightPath version 7.5 Description: The issue allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the Last Name...

CVE-2017-13314: Missing Authorization

In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with...

The vulnerability of Siemens SINEC Security Monitor, a network security monitoring application, arises from an improper restriction on the path name to the restricted directories. This allows attackers to create files in arbitrary directories.

The vulnerability of the Siemens SINEC Security Monitor network security monitoring application is related to an incorrect restriction on the path name to the restricted directories. Exploiting this vulnerability could allow a malicious actor to create files in arbitrary directories remotely...

PT-2024-27964

Name of the Vulnerable Software and Affected Versions GLPI versions 9.2.0 through 10.0.15 Description The issue allows unauthorized download of documents from the API without appropriate rights. Recommendations Upgrade to version 10.0.16 to resolve the issue. As a temporary workaround, consider...