CVE-2024-36800

A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php...

CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy ...

CVE-2024-36036: Missing Authorization

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive information and modifying the agent configuration...

PT-2024-9386

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions through 9.8.0.33 Description A flaw exists in the NuPoint Messenger NPM component of Mitel MiCollab due to inadequate sanitization of user-supplied data. This allows a remote, unauthenticated attacker to perform a SQL...

ROS-20240521-09

A vulnerability in the JSSE component of the Oracle Java SE software platform and Oracle GraalVM virtual machine. Enterprise Edition is related to the lack of message integrity checking. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information or...

ROS-20240521-10

A vulnerability in the JSSE component of the Oracle Java SE software platform and Oracle GraalVM virtual machine. Enterprise Edition is related to the lack of message integrity checking. Exploitation of the vulnerability could allow an attacker acting remotely to disclose protected information or...

Cybozu Garoon Information Disclosure Vulnerability (CNVD-2024-29670)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. An information disclosure vulnerability exists in Cybozu Garoon, which originates from improperly restricting the...

PT-2024-4555

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions prior to 3.68.1 Description A path traversal issue exists in Sonatype Nexus Repository 3 due to improper restriction of directory path names. This allows an unauthenticated remote attacker to read sensitive...

CVE-2024-20258

Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway has a web-based management interface vulnerability that enables cross-site scripting (XSS) due to insufficient input validation. An unauthenticated, remote attacker could lure a user to click a crafted link, al...

CVE-2024-20392

CVE-2024-20392 describes a vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway. The flaw arises from insufficient input validation of parameters passed to the API, enabling an unauthenticated, remote attacker to perform an HTTP response splitting...

CVE-2024-20392

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to t...

XML Entity Injection Vulnerability in Linkworks Collaborative Office Management Platform at Quanta Technology Co.

Linkworks Collaboration Management Platform is a BIM collaboration platform developed by Quanta. An XML entity injection vulnerability exists in Linkworks Collaborative Office Management Platform of Quanta Technology Corporation, which can be exploited by attackers to obtain sensitive information...

CVE-2024-31556

Reportico Web versions prior to v.8.1.0 are vulnerable to an issue in the sessionid function. This flaw allows a local attacker to execute arbitrary code and access sensitive information . Additionally, documentation reveals that the application fails to properly invalidate session cookies upon l...

CVE-2024-31556

An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function...

CVE-2024-2299 Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui

A stored Cross-Site Scripting XSS vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is...

Google Android Information Disclosure Vulnerability (CNVD-2024-27516)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

PT-2024-18779 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 25.0.0.41 Description: The issue is related to improper privilege management, allowing local attackers to bypass protection for cookies. This enables them to access sensitive information without proper...

Mitel 6800 SIP 和 6900 SIP 安全漏洞

Mitel 6800 SIP and Mitel 6900 SIP are both products of Mitel Canada.Mitel 6800 SIP is a 6800 SIP series IP phone.Mitel 6900 SIP is a 6900 SIP series IP phone. A security vulnerability exists in the Mitel 6800 SIP and 6900 SIP that stems from insufficient boundary checking, and successful...

CVE-2024-31965

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct a path traversal attack due to insufficient input...

CVE-2024-31966

Mitel 6800 Series and 6900 Series SIP Phones (through 6.3 SP3 HF4), 6900w Series SIP Phones (through 6.3.3), and 6970 Conference Units (through 5.1.1 SP8) are vulnerable to an argument injection attack . The root cause is insufficient parameter sanitization within the microprogramming software. A...