2461 matches found
Fortinet FortiDeceptor Cross-Site Scripting Vulnerability
Fortinet FortiDeceptor is a cyber threat detection platform from the American company Fiat Fortinet. The platform focuses on exposing cyber threats through deception techniques, among other things. Fortinet FortiDeceptor cross-site scripting vulnerability, the vulnerability stems from the...
WAVLINK AC3000 adm.cgi set_TR069 Function Command Injection Vulnerability
WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which stems from the failure of the adm.cgi setTR069 function to correctly filter constructed command special characters, commands, etc. The...
Microsoft Windows Hyper-V NT Kernel Integration VSP elevation of privilege vulnerability (CNVD-2025-05240)
Microsoft Windows Hyper-V is a tool from Microsoft USA that provides hardware virtualization. An elevation of privilege vulnerability exists in Microsoft Windows Hyper-V NT Kernel Integration VSP, which can be exploited by an attacker to gain elevated privileges on a system...
CVE-2025-23199 Stored XSS-LibreNMS-Ports in librenms
librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: /ajaxform.php - param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...
D-Link DIR-816 A2 /goform/form2IPQoSTcAdd Access Control Error Vulnerability
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2IPQoSTcAdd. An attacker can exploit this vulnerability to be able to set th...
D-Link DIR-816 A2 /goform/form2NetSniper.cgi Access Control Error Vulnerability
The D-Link DIR-816 A2 is a wireless router from China's AUO D-Link. An access control error vulnerability exists in D-Link DIR-816 A2 version 1.10CNB05R1B011D88210, which stems from improper access control in /goform/form2NetSniper.cgi. An attacker can exploit this vulnerability to be able to set...
CVE-2025-0485
A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfigdoedit.php. The manipulation of the argument info leads to cross site scripting. It is possible to launch the attack remotely. The exploi...
Hackers Use CVE-2024-50603 to Deploy Backdoor on Aviatrix Controllers
A critical vulnerability CVE-2024-50603 in the Aviatrix Controller allows unauthenticated RCE. Active exploitation observed by Wiz Research in…...
CVE-2024-36290
A buffer overflow vulnerability exists in the login.cgi Gotochidx functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...
CVE-2024-39773
An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2025-20055
OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...
Microsoft Excel Security Feature Bypass Vulnerability
...
Open Redirection
github.com/h44z/wg-portal is vulnerable to Open Redirection. The vulnerability is due to improper handling of OAuth or OIDC authentication backends, which can be exploited when a user visits a malicious website in WireGuard Portal v2...
Schneider Electric RemoteConnect and SCADAPack x70 Utilities (Update A)
RISK EVALUATION Successful exploitation of this vulnerability could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...
WebKit DocumentFontLoader::fontLoadingTimerFired Use-After-Free
WebKit suffers from a use-after-free vulnerability in DocumentFontLoader::fontLoadingTimerFired. https://packetstorm.news/download/188628...
Exploit for CVE-2024-9950
CVE-2024-9950-PoC Forescout SecureConnector = 11.3.07...
Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603)
The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane. Organizations should patch urgently...
CVE-2024-12847 NETGEAR DGN setup.cgi OS Command Injection
NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited ...
Apple macOS libFontValidation Font Header Name Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the libFontValidation library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists...