CVE-2024-46887

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

IDEC CORPORATION WindLDR and WindO/I-NV4

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely Vendor : IDEC Corporation Equipment : WindLDR, WindO/I-NV4 Vulnerability : Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain...

CVE-2024-45103

The CVE-2024-45103 issue affects Lenovo XClarity Administrator (LXCA). The vulnerability arises when an authenticated LXCA user can unmanage an LXCA-managed device via the LXCA web interface without sufficient privileges, indicating a privilege-escalation risk within the web management flow. Tech...

CVE-2024-45103

A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges...

CVE-2024-45504

CVE-2024-45504 is a CSRF vulnerability affecting multiple Alps System Integration products and OEMs, allowing a remote unauthenticated attacker to perform unintended actions if a logged-in user views a malicious page. Affected products/components include Alps InterSafe GatewayConnection, InterSaf...

Online Survey System 1.0 SQL Injection

============================================================================================================================================= | Title : Online Survey System 1.0 auth by pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 128.0.3 6...

CVE-2024-8462 Windmill HTTP Request users.rs excessive authentication

A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is...

PT-2024-5902

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.38 Zyxel USG FLEX series versions 4.50 through 5.38 Zyxel USG FLEX 50W series versions 4.16 through 5.38 Zyxel USG20W-VPN series versions 4.16 through 5.38 Description: A command injection vulnerabilit...

MediaWiki SVG XML Entity Expansion Remote File Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MediaWiki SVG XML Entity Expansion Remote File Access', 'Description' = %q This module attempts to read a remote file from the server using a...

Cambium CnPilot R200/r201 Login Scanner And Config Dump

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cambium cnPilot r200/r201 Login Scanner and Config Dump', 'Description' = % This module scans for Cambium cnPilot r200/r201 management login...

GitLab Authenticated File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GitLab Authenticated File Read', 'Description' = %q GitLab version 16.0 contains a directory traversal for arbitrary file read as the gitlab-www...

WordPress WPLMS Theme Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress WPLMS Theme Privilege Escalation', 'Description' = %q The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an authenticated...

Chromecast Factory Reset Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Chromecast Factory Reset DoS', 'Description' = %q This module performs a factory reset on a Chromecast, causing a denial of service DoS. No user...

Accessing Confluence using PAT Token fails intermittently when multiple users access concurrently

h3. Issue Summary This issue is similar to the one reported in Jira side under JRASERVER-76340|https://jira.atlassian.com/browse/JRASERVER-76340 This is reproducible on Data Center: Yes h3. Steps to Reproduce Provision a new Confluence environment Create two new users: "usera" and "userb" For eac...

Login System Project 1.0 SQL Injection

============================================================================================================================================= | Title : Login System Project 1.0 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 129.0.1 6...

CVE-2024-7503 WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover

The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'wooslgconfirmemailuser' function. This makes it possible for unauthenticated attackers to l...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

Virtuozzo Hybrid Infrastructure 6.2 Hotfix 2 (6.2.0-142)

This update provides security and stability fixes. Vulnerability id: VSTOR-75009, VSTOR-76816, VSTOR-87057 Stability fixes for the hypervisor. Vulnerability id: VSTOR-87588 Fixed an issue with storage space calculation for the "Other" category in the "Logical space" chart in the admin panel...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 5 (6.1.1-49)

This update provides security and stability fixes. Vulnerability id: VSTOR-75009, VSTOR-76816 Stability fixes for the hypervisor. Vulnerability id: VSTOR-85653, VSTOR-87742 Stability fixes for the chunk service. Vulnerability id: VSTOR-88832 A security fix for networks. Vulnerability id:...

LDAP Communication Error on XenMobile Device Manager

The following LDAP communication error appears on XenMobile Device Manager: javax.naming.CommunicationException: simple bind failed: xxxx-xxx-xxx.xxx.xxx.com:666Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:...