CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue...

CVE-2024-52601

CVE-2024-52601 – iTop portal exposure is a read-access flaw in the web-based IT Service Management tool iTop. Prior to versions 2.7.12, 3.1.3, and 3.2.1, accounts with portal access could read objects they are not permitted to see by querying an unprotected route (Insecure Direct Object Reference...

iTop 安全漏洞

iTop is a simple, web-based IT service management tool from Combodo Open Source. A security vulnerability exists in iTop versions prior to 2.7.12, 3.1.3, and 3.2.1, which stems from unprotected routing leading to unauthorized access...

The vulnerability of TOTOLINK N150RT router microprogramming software arises from the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of TOTOLINK N150RT router microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of TOTOLINK N150RT router microprogramming software arises from the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of TOTOLINK N150RT router microprogramming software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2025-46191

Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attacker...

CVE-2025-4286

A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to...

CVE-2025-20210 Cisco Catalyst Center Unprotected API Endpoint

A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings. This vulnerability is due to the lack of authentication in an API endpoint. An attacker could...

CVE-2025-46816 goshs route not protected, allows command execution

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitra...

goshs route not protected, allows command execution

Summary It seems that when running goshs without arguments it is possible for anyone to execute commands on the server. This was tested on version 1.0.4 of goshs. The command function was introduced in version 0.3.4. Details It seems that the function dispatchReadPump does not checks the option c...

CVE-2024-45562

Memory corruption during concurrent access to server info object due to unprotected critical field...

Missing Authorization

org.springframework.boot is vulnerable to Missing Authorization. The vulnerability is due to incorrect request matching caused by EndpointRequest.to creating a matcher for null/ when the targeted actuator endpoint is disabled or not exposed, which allows unprotected access to the /null path...

CVE-2025-4286

A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to...

CVE-2025-4286 Intelbras InControl Dispositivos Edição Page credentials storage

A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to...

CVE-2025-4286

CVE-2025-4286 affects Intelbras InControl (versions up to 2.21.59). The vulnerability is in an unknown function of the Dispositivos Edição Page, where manipulation of the Senha de Comunicação argument results in unprotected credential storage. It can be exploited remotely, and public exploits hav...

The vulnerability of TP-Link M7200 4G LTE Mobile Wi-Fi Router’s microprogramming software lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of TP-Link M7200 4G LTE Mobile Wi-Fi Router’s microprogramming software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing specially crafted SQL code remotel...

The vulnerability of TP-Link M7000 4G LTE Mobile Wi-Fi Router’s microprogramming software lies in the lack of measures taken to protect the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of TP-Link M7000 4G LTE Mobile Wi-Fi Router’s microprogramming software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing specially crafted SQL code remotel...

The vulnerability of the Login Dashboard component of TP-Link’s router software lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the Login Dashboard component of TP-Link’s microprogramming router TL-WR840N relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by introducing specially crafted SQL code...

The vulnerability of the LockGateway method in the software for managing and monitoring remote devices in telemetry and telemechanics systems allows a hacker to bypass security restrictions and gain access to write and read arbitrary files.

The vulnerability of the LockGateway method in software for managing and monitoring remote devices in telemetry and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to bypass security restrictio...

The vulnerability of the UnlockDatabaseSettings method in the software for managing and monitoring deleted objects in telemetry and telemechanics systems, allows a hacker to circumvent security restrictions and gain access to write and read arbitrary files.

The vulnerability of the UnlockDatabaseSettings method in the software for managing and monitoring deleted objects in telemetry and telemechanics systems related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to bypass security...