136 matches found
CVE-2023-2386
A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?page=firewalllogsemail.htm of the component Web Management Interface. The manipulation of the argument smtpServer.toAddr leads to cross site...
CVE-2025-44897
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftpsrvip parameter in the webtoolupgradeManagerpost function...
VulnCheck KEV: CVE-2025-2776
SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...
SysAid On-Prem 安全漏洞
SysAid On-Prem is a locally deployed IT Service Management ITSM platform from SysAid Israel. A security vulnerability exists in SysAid On-Prem versions 23.3.40 and earlier, which stems from an unvalidated XML external entity vulnerability in the Server URL handling feature that could lead to...
The vulnerability of the updateWifiInfo() function in TOTOLINK T8 router software allows a hacker to execute arbitrary commands.
The vulnerability of the updateWifiInfo function in TOTOLINK T8 router microprogramming software is related to the lack of measures taken to clean data at the control level when processing the serverIp parameter. Exploiting this vulnerability could allow a remote attacker to execute arbitrary...
The vulnerability of the meshSlaveDlfw() function in the microprogramming software for TOTOLINK T8 allows a hacker to execute arbitrary commands.
The vulnerability of the meshSlaveDlfw function in the microprogramming software for TOTOLINK T8 routers is related to the lack of measures taken to clean data at the management level when processing the serverIp parameter. Exploiting this vulnerability allows a remote attacker to execute arbitra...
SUSE CVE-2025-27090
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the...
CVE-2025-0425
Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions "nt authority\system". By changing the...
Sliver 代码问题漏洞
Sliver is an open source cross-platform adversary simulation/red teaming framework from Bishop Fox Open Source. It can be used by organizations of all sizes to perform security testing. Sliver suffers from a code issue vulnerability that stems from unverified reverse port forwarding, leading to...
CVE-2025-0425
Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions "nt authority\system". By changing the...
CVE-2025-0425 Local Privilege Escalation via Config Manipulation
Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this client connects. This is dangerous as the "bestinformed Infoclient" runs with elevated permissions "nt authority\system". By changing the...
CVE-2025-0425
Cordaware bestinformed Infoclient is vulnerable to local privilege escalation: a low-privileged user can change the server address to a malicious or spoofed server, enabling elevation to nt authority\system on Windows. This relies on default GUI permissions and can be mitigated by deploying a cus...
PT-2025-6786 · Bestinformed +1 · Bestinformed Infoclient +1
Name of the Vulnerable Software and Affected Versions: bestinformed Infoclient affected versions not specified Description: A low-privileged user can change the server address of the bestinformed Server to which the bestinformed Infoclient connects, allowing them to escalate their privileges by...
Cordaware bestinformed 安全漏洞
Cordaware bestinformed is a mass notification system from Cordaware, Germany. A security vulnerability exists in Cordaware bestinformed that stems from a server address modification permission issue that could result in local privileges being elevated to SYSTEM...
Orchid 安全漏洞
Orchid is a free Laravel package open-sourced by Orchid. A security vulnerability exists in Orchid versions prior to 14.43.0, which stems from a method exposure issue in the Asynchronous Mode feature, which could potentially brute-force a database table, perform authentication checks against user...
The vulnerability of the version/query_to_xml/inet_server_addr/inet_client_addr function in Apache Superset visualization software allows a hacker to bypass existing security restrictions.
The vulnerability of the version/querytoxml/inetserveraddr/inetclientaddr functions in Apache Superset visualization software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to circumvent existing security...
Store Configuration by Server Based Discovery Fails
When attempting to configure Receiver Stores by entering in address of StoreFront server in Email/Server Based Discovery dialog, the following error appears: "Your account cannot be added using this server address. Make sure you entered it correctly. You may need to enter your email address...
CVE-2023-44427
D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this...
D-Link DIR-X3260 安全漏洞
D-Link DIR-X3260 is a Wi-Fi 6 router from China-based D-Link. A security vulnerability exists in the D-Link DIR-X3260 that stems from a remote code execution vulnerability in the SetSysEmailSettings SMTPServerAddress command injection...