PT-2024-36538 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200 version 3.90 Raisecom MSG2100E version 3.90 Raisecom MSG2200 version 3.90 Raisecom MSG2300 version 3.90 Description: A vulnerability was found in the web interface of Raisecom devices, specifically in the /upload sfmig.php...

Cisco Secure Firewall Management Center SQL Injection

The vulnerability of the Web interface for managing Cisco Secure Firewall Management Center software formerly known as Cisco Firepower Management Center is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute...

PT-2025-2017 · Dahua · Dahua Ipc-Hfw2300R-Z +2

Name of the Vulnerable Software and Affected Versions: Dahua IPC-HFW1200S versions up to 20241222 Dahua IPC-HFW2300R-Z versions up to 20241222 Dahua IPC-HFW5220E-Z versions up to 20241222 Dahua IPC-HDW1200S versions up to 20241222 Description: A problematic vulnerability has been found in the Web...

TP-Link Archer C50 Code Execution

The vulnerability in the web interface of TP-Link Archer C50 Wi-Fi routers involves loading code without checking its integrity. Exploiting this vulnerability allows an attacker to execute arbitrary code and cause service failures...

TP-Link Archer C50 Unauthenticated Access

The vulnerability of the web-based management interface for TP-Link Archer C50 wireless routers involves the unencrypted storage of critical information. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the credentials of the target Wi-Fi system...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local network repeatedly requests the /accessdenied URL...

CVE-2024-10511

The provided connected documents identify CVE-2024-10511 as an Improper Authentication (CWE-287) vulnerability in Schneider Electric PowerChute Serial Shutdown. The issue can cause Denial of Access to the PCSS web UI when a local-network attacker repeatedly requests the /accessdenied endpoint. Af...

SOLDR Threat Detection XSS

The vulnerability of the SOLDR threat detection and analysis web interface exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS by injecting malicious JavaScript code...

CVE-2024-55546 Stored Cross-Site Scripting

Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55546

The CVE refers to ORing IAP-420, where the web interface lacks input validation, allowing stored XSS in versions 2.01e and earlier. The incident is described across multiple sources (Red Hat/CNNVD/CVE records and PT-Security). Root cause: insufficient input validation in the product’s web interfa...

CVE-2024-55544

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55544 Authenticated Command Injection

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55544 Authenticated Command Injection

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55544

CVE-2024-55544 concerns ORing IAP-420 devices. The connected documents consistently identify a vulnerability due to missing input validation in the web interface , affecting versions 2.01e and below . The core consequence described is authenticated command injections on the OS level . Some source...

CVE-2024-28138

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...

CVE-2024-28138 OS Command Injection

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...

CVE-2024-28138 OS Command Injection

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msgevents.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized...

CVE-2024-28138

Image Access Scan2Net versions 7.40 and earlier , 7.42 and earlier , and 7.42B and earlier are vulnerable to an OS Command Injection (CWE-78). The root cause is the improper sanitization of the HTTP GET parameter "data" within the "msg_events.php" script. An unauthenticated attacker with network ...

PT-2024-36544

Name of the Vulnerable Software and Affected Versions ORing IAP-420 versions 2.01e and below Description The issue is caused by missing input validation in the web interface of ORing IAP-420, allowing stored Cross-Site Scripting XSS. This enables attackers to store malicious scripts on the device...