Vulnerabilities fixed in Ivanti Cloud Services Appliance

Ivanti has fixed vulnerabilities in Cloud Services Appliance v 4.6. A malicious party could exploit the vulnerabilities to execute a command-injection via path-traversal, allowing the system to be operated and possibly taken over without prior authentication. Ivanti says it has information that t...

Exploit for Cross-Site Request Forgery (CSRF) in Creativeitem Academy_Lms

CVE-2022-47132 Academy LMS = 5.10 CSRF Description Acad...

AZL-49675 CVE-2024-46784 affecting package kernel for versions less than 5.15.182.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix error handling in manacreatetxq/rxq's NAPI cleanup Currently napidisable gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic. ?...

DesDev DedeCMS 跨站脚本漏洞

DesDev DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS from China Zhuozhuo DesDev. The system has content publishing, content management, content editing and content retrieval functions. A security vulnerability exists in DesDev DedeCMS...

Yordam Library Automation System 安全漏洞

Yordam Library Automation System is an application from Yordam, Inc. A security vulnerability exists in Yordam Library Automation System prior to version 5.0, which stems from an unauthorized exposure of sensitive information vulnerability that allows retrieval of embedded sensitive data...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

CVE-2023-37230

Loftware Spectrum testDeviceConnection before 5.1 allows SSRF...

Zyxel NAS542和NAS326 操作系统命令注入漏洞

Zyxel NAS542 and Zyxel NAS326 are both products of the Chinese company Hopkins Zyxel.Zyxel NAS542 is a NAS Network Attached Storage device.Zyxel NAS326 is a cloud storage NAS. An operating system command injection vulnerability exists in Zyxel NAS326 version V5.21AAZF.18C0 and earlier and NAS542...

PT-2024-28538

Name of the Vulnerable Software and Affected Versions Dell PowerScale InsightIQ versions 5.0 through 5.1 Description The issue is related to an Improper Access Control vulnerability. A high-privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of...

CVE-2024-44725

AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php...

PT-2024-31222 · Autocms · Autocms

Name of the Vulnerable Software and Affected Versions: AutoCMS version 5.4 Description: The issue allows attackers to execute arbitrary PHP code via injecting a crafted value into the txtsite url parameter at the "/admin/site add.php" API endpoint. This enables attackers to inject malicious PHP...

AutoCMS 安全漏洞

AutoCMS is a content management system CMS from AutoCMS Open Source. It can help dealerships manage their website content, online advertising, social media and analytics. AutoCMS version 5.4 suffers from a SQL injection vulnerability that originates from the lack of validation of externally enter...

za-internet C-MOR Video Surveillance 安全漏洞

za-internet C-MOR Video Surveillance is a network video surveillance system from the German company za-internet. A security vulnerability exists in za-internet C-MOR Video Surveillance version 5.2401, which stems from improper input validation leading to reflective cross-site scripting...

PT-2024-31454 · Za Internet · Za-Internet C-Mor Video Surveillance

Name of the Vulnerable Software and Affected Versions: za-internet C-MOR Video Surveillance version 5.2401 Description: An issue was discovered due to improper or missing access control, allowing low privileged users to use administrative functions of the C-MOR web interface. Although different...

MingSoft MCMS 安全漏洞

MingSoft MCMS is a complete open source J2ee system from China's MingFei MingSoft. A security vulnerability exists in MingSoft MCMS version v5.4.1, which stems from improper handling of the front-end file upload function, and could lead to remote command execution...

PT-2024-25269 · Espressif · Esp-Idf

Name of the Vulnerable Software and Affected Versions: esp-idf version 5.1 Description: A Buffer Overflow issue allows a remote attacker to obtain sensitive information via the externalId component. Recommendations: For esp-idf version 5.1, at the moment, there is no information about a newer...

PT-2024-36053 · Zyxel · Zyxel Vmg8825-T50K

Name of the Vulnerable Software and Affected Versions: Zyxel VMG8825-T50K firmware version 5.50ABOM.8C0 Description: A buffer overflow vulnerability in the library "libclinkc" could allow an unauthenticated attacker to cause denial of service DoS conditions by sending a crafted HTTP request to a...

OESA-2024-2082 tpm2-tools security update

The package contains the code for the TPM Trusted Platform Module 2.0 tools based on tpm2-tss. Security Fixes: tpm2-tools is the source repository for the Trusted Platform Module TPM2.0 tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This...

OESA-2024-2083 tpm2-tools security update

The package contains the code for the TPM Trusted Platform Module 2.0 tools based on tpm2-tss. Security Fixes: tpm2-tools is the source repository for the Trusted Platform Module TPM2.0 tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This...

CVE-2024-43921

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Magic Post Thumbnail allows Reflected XSS.This issue affects Magic Post Thumbnail: from n/a through 5.2.9...