CVE-2024-28038

The CVE-2024-28038 entry describes a stack-based buffer overflow in the web interface of Sharp/MFP devices caused by an overly long MFPSESSIONID cookie value. Affected component: web interface (cookie handling) of Sharp MFPs; root cause: improper processing of cookie values leading to overflow. I...

CVE-2024-8772

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited...

CVE-2024-8772

The CVE-2024-8772 issue affects AXIS OS (AXIS devices) via the VAPIX API endpoint managedoverlayimages.cgi. The vulnerability is a race condition that can be exploited to block access to the overlay configuration page in the web interface, and it requires authentication with an operator- or admin...

PT-2024-26933 · Sharp +1 · Multiple Mfps +18

Name of the Vulnerable Software and Affected Versions: Affected devices affected versions not specified Description: The web interface of the affected devices processes some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef sub sel.htm...

VulnCheck KEV: CVE-2022-30075

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation...

PT-2024-25724 · Sharp +1 · Multiple Mfps

Name of the Vulnerable Software and Affected Versions: No specific product names, model numbers, or versions are mentioned in the provided descriptions. Description: The issue concerns the web interface of affected devices, which is designed to hide LDAP credentials from administrative users...

The vulnerability in the web interface of the software for managing SINEC INS network infrastructure’s management system arises from incorrect validation of input data. This allows a hacker to execute arbitrary code.

The vulnerability of the web interface for managing software used to manage SINEC INS network infrastructure is related to improper validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability in the web interface of the SINEC INS software for managing network infrastructure stems from a user authentication check error. This allows a malicious individual to obtain information about the list of users of the SFTP service and to alter its configuration.

The vulnerability in the software web interface for managing network infrastructure SINEC INS is related to an authentication check error for requesting the final endpoint "/api/sftp/users". Exploiting this vulnerability could allow a attacker to obtain information about the user list of the SFTP...

A vulnerability in the web interface for managing SINEC INS software, which manages network infrastructure, exists. This vulnerability is related to an incorrect session expiration time, allowing attackers to maintain a session after deleting the account.

The vulnerability in the web interface for managing SINEC INS software-related network infrastructure is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to maintain a session after deleting the account...

PT-2024-13217 · Ibm · Ibm Jazz Foundation

Name of the Vulnerable Software and Affected Versions: IBM Jazz Foundation versions 7.0.2 and below Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

The vulnerability in the web interface of the Cisco Nexus Dashboard Fabric Controller (NDFC) allows a perpetrator to execute arbitrary code.

The vulnerability of the Cisco Nexus Dashboard Fabric Controller NDFC web interface relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in a container with root privileges...

The vulnerability of the web interface of the Cisco Nexus Dashboard Fabric Controller (NDFC) management platform, which involves unencrypted storage of data in files or on disks, allows attackers to disclose protected information.

The vulnerability of the web interface of the Cisco Nexus Dashboard Fabric Controller NDFC management platform involves unencrypted storage of data in files or on disks. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Cross-Site Scripting

Deluge Web-UI is vulnerable to a Cross-Site Scripting. The vulnerability is due to improper sanitization of data from torrent files, where crafted torrent metadata is rendered directly as HTML, allowing attackers to execute arbitrary JavaScript in the user’s browser when a malicious torrent file ...

CVE-2024-5720

Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing...

CVE-2024-5718

Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific...

Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os

cve-2024-0012-poc CVE-2024-0012 is an authentication bypass v...

SEH utnserver Pro 20.1.22 Cross Site Scripting

St. Pölten UAS 20241118-0 ------------------------------------------------------------------------------- title| Multiple Stored Cross-Site Scripting product| SEH utnserver Pro vulnerable version| 20.1.22 fixed version| 20.1.35 CVE number| CVE-2024-11304 impact| High homepage|...

CVE-2024-28026

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-28027

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-28027

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...