CVE-2024-47555

Missing Authentication - User & System Configuration...

CVE-2024-47555 Missing Authentication - User & System Configuration

Missing Authentication - User & System Configuration...

CVE-2024-47555

CVE-2024-47555 affects Xerox FreeFlow Core with a missing authentication vulnerability. According to the CVSS 3.1 vector, the issue is exploitable from an adjacent network, has high impact on confidentiality, integrity, and availability, and requires no user interaction. The root cause is a broke...

CVE-2024-47555 Missing Authentication - User & System Configuration

Missing Authentication - User & System Configuration...

CVE-2024-24116

An issue in Ruijie RG-NBS2009G-P RGOS v.10.41P2 Release9736 allows a remote attacker to gain privileges via the system/configmenu.htm...

CVE-2024-45408 eLabFTW contains a direct and indirect information disclosure

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...

ASB-A-343714914

In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-8456

Certain switch models from PLANET Technology lack proper access control in firmware upload and download functionality, allowing unauthenticated remote attackers to download and upload firmware and system configurations, ultimately gaining full control of the devices...

PLANET switch devices 访问控制错误漏洞

PLANET switch devices are a series of switch devices from PLANET Corporation in China. An access control error vulnerability exists in PLANET switch devices, which stems from a lack of proper access control for the firmware upload and download functions, allowing an unauthenticated, remote attack...

CVE-2024-39341

Entrust Instant Financial Issuance On Premise Software formerly known as Cardwizard 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file i.e. WebAPI.cfg.xml after the installation process. This file can be accessed without authentication on HTTP port 80 by guessin...

Accellion FTA Statecode Cookie Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Accellion FTA 'statecode' Cookie Arbitrary File Read", 'Description' = %q This module exploits a file disclosure vulnerability in the Accellion...

CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

UBUNTU-CVE-2024-43442

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

CVE-2024-43442

CVE-2024-43442 describes a Cross-Site Scripting (XSS) vulnerability in OTRS/System Configuration where an attacker with admin privileges can target other admins due to improper input neutralization. Affected versions include OTRS 7.0.X–7.0.50, 8.0.X, 2023.X, 2024.X–2024.5.X, and ((OTRS)) Communit...

CVE-2024-43442 Stored XSS in System Configuration

Improper Neutralization of Input done by an attacker with admin privileges 'Cross-site Scripting' in OTRS System Configuration modules and OTRS Community Edition allows Cross-Site Scripting XSS within the System Configuration targeting other admins. This issue affects: OTRS from 7.0.X through...

PT-2024-5943 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 7.0.50 OTRS version 8.0.X OTRS version 2023.X OTRS versions 2024.X through 2024.5.X OTRS Community Edition version 6.0.x Description: The issue exists due to improper neutralization of input, allowing an attacker...

CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

Information Exposure

pimcore/admin-ui-classic-bundle is vulnerable to Information Exposure. The vulnerability is due to the exposure of installation and system details to logged-in users at /admin/index/statistics, which allows to gain insights into the system's configuration and potential weaknesses...

The vulnerability of the I/O Trace Tool (formerly NI-Spy) detection and analysis utility for applications within the System Configuration package allows a hacker to execute arbitrary code by causing an operation to go beyond the buffer boundaries in memory.

The vulnerability of the I/O Trace Tool formerly NI-Spy detection and analysis utility in the System Configuration package is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a attacker to execute arbitrary code using a specially...