PT-2024-14844 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: Arc affected versions not specified Description: The local web interface provided during the configuration of Arc lacks authentication, making it vulnerable to abuse by local attackers or malware. This could allow a malicious local user or...

CVE-2024-32977

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-31485

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...

CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the autologinLocal option is enabled within config.yaml, even if the...

CVE-2024-31485

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...

CVE-2024-31485

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V5.30, SICORE Base system All versions V1.3.0. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated...

CVE-2020-18305

Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges...

PT-2024-3749 · Unknown · Cpci85 Central Processing/Communication +1

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.30 SICORE Base system versions prior to V1.3.0 Description: A command injection vulnerability exists due to missing server-side input sanitation in the web interface of affected...

PT-2024-15561 · WordPress · Password Protect

Name of the Vulnerable Software and Affected Versions: Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease versions up to, and including, 2.6.6 Description: The issue allows authenticated attackers with subscriber access or higher to extract post titles and...

PT-2024-10784 · Extreme Networks · Extreme Networks Exos

Name of the Vulnerable Software and Affected Versions: Extreme Networks EXOS versions prior to 22.7 Extreme Networks EXOS versions prior to 30.2 Description: The issue is related to the Web GUI of Extreme Networks EXOS, which fails to restrict URL access. This allows attackers to access sensitive...

OESA-2024-1552 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: An SSRF issue was discovered in cockpit-project.org Cockpit 234...

PT-2024-25514 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered where HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. Recommendations: For versions prior to 7.4.0, update to version...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

CVE-2024-23188

Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session. Common user interaction is required for the vulnerability to trigger. Attackers could perform malicious API requests or extract information from the users...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

The vulnerability in the web interface of the microprogramming software for Cisco IP Phones 6800, 7800, 8800, and 8875 allows a perpetrator to cause a service failure.

The vulnerability of the web-based management interface for Cisco IP Phones 6800, 7800, 8800, and 8875 lies in the fact that operations are performed outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failure by sending specially crafted...

PT-2024-19702 · Open Xchange Gmbh +1 · Ox App Suite

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could...

编号撤回

Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. This CVE number has been withdrawn...

CVE-2023-42121

Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...