CVE-2024-47553

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate user input to the ssmctl-client command. This could allow an authenticated, lowly privileged remote attacker to execute arbitrary code with root privileges on the...

CVE-2024-47553

CVE-2024-47553 affects Siemens SINEC Security Monitor (all versions

Prototype Pollution

@sentry/browser is vulnerable to Prototype Pollution. The vulnerability is due to inadequate checks on user input or unsafe handling of data within an application when data is not properly validated or sanitized. It allows attackers to manipulate the prototype of objects, leading to potential...

CVE-2024-9572 Cross-Site Scripting vulnerability in SOPlanning

Cross-Site Scripting XSS vulnerability in SOPlanning 1.45, due to lack of proper validation of user input via /soplanning/www/process/groupesave.php, in the groupeid parameter. This could allow a remote user to send a specially crafted query to an authenticated user and steal their session detail...

Cross Site Scripting(XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation and sanitization of user input in the "Alert Transports" feature, specifically in the "Details" section, which allows authenticated users to inject arbitrary JavaScript code executable...

CVE-2024-41925 Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code...

CVE-2024-20520

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability, an attacker would need to have valid...

CVE-2024-20524 Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service DoS condition. To exploit...

CVE-2024-20517 Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities

A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial of service DoS condition. To exploit...

CVE-2024-20517

CVE-2024-20517 affects Cisco Small Business RV042, RV042G, RV320, and RV325 routers. A vulnerability in the web-based management interface allows an authenticated Administrator to trigger an unexpected device reload, causing DoS. Root cause: improper validation of user input in incoming HTTP pack...

PT-2024-39555 · Sourcecodester · Sourcecodester Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Railway Reservation System version 1.0 Description: A problematic issue was found in the Message Us Form component, specifically in the contact us.php file. The manipulation of the fullname, email, or message arguments...

Cross-site Scripting (XSS)

mautic/core is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation and sanitization of user input, allowing harmful scripts to be saved and later executed in the context of other users’ sessions...

CVE-2024-8778 The SYSCOM Group OMFLOW - Arbitrary File Read

OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files...

Ivanti Endpoint Manager updateAssetInfo SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the updateAssetInfo method. The issue results from the lack of...

GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

USN-6841-2: PHP vulnerability

USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that PHP could early return in the filtervar function resulting in invalid user information being treated as valid user...

C-MOR Video Surveillance 5.2401 Path Traversal

Advisory ID: SYSS-2024-025 Product: C-MOR Video Surveillance Manufacturer: za-internet GmbH Affected Versions: 5.2401 Tested Versions: 5.2401 Vulnerability Type: Relative Path Traversal CWE-23 Risk Level: High Solution Status: Fixed Manufacturer Notification: 2024-04-05 Solution Date: 2024-07-31...

CVE-2024-45171

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup file...

CVE-2024-45176

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting XSS attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to...

CVE-2024-45178

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, du...