Xiongmai NVR devices 缓冲区错误漏洞

Xiongmai NVR devices are a series of network video recorders from China-based Xiongmai Technology Xiongmai. A security vulnerability exists in Xiongmai NVR devices that stems from the presence of a stack-based buffer overflow. An attacker can exploit this vulnerability by sending a specially...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

CLSA-2023-1679943745 Fix CVE(s): CVE-2023-25690

SECURITY UPDATE: proxy configuration may trigger HTTP request smuggling attack - debian/patches/CVE-2023-25690.patch: don't forward invalid query strings - CVE-2023-25690...

PT-2023-19530 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 6.8.0 Description: The issue allows attackers to download sensitive files via a crafted HTTP request, potentially exposing sensitive information. Recommendations: For rConfig version 6.8.0, at the moment, there is no informati...

Osprey Pump Controller 安全漏洞

Osprey Pump Controller is a pump controller from Osprey. A security vulnerability exists in Osprey Pump Controller version 1.01. An attacker can exploit this vulnerability to obtain arbitrary files and sensitive system information from an affected device using GET parameters...

PT-2023-2244 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2018 Update 15 and earlier Adobe ColdFusion versions 2021 Update 5 and earlier Description: The issue exists due to improper limitation of a pathname to a restricted directory, allowing an attacker to read arbitrary...

Mozilla Firefox 缓冲区错误漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox's handling of data, which can be exploited by a remote attacker to submit a specially crafted web request that the user can be tricked into parsing,...

The vulnerability of the TrueConf Server software, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the TrueConf Server software is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially crafted HTTPS request...

CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

Fortinet FortiSOAR 安全漏洞

Fortinet FortiSOAR is a security orchestration, automation and response SOAR solution from Fortinet. Fortinet FortiSOAR suffers from an Access Control Error vulnerability that stems from improper access control in the program. An authenticated attacker could exploit this vulnerability to perform...

The vulnerability in the Nagios XI monitoring tool’s script located at `/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious...

The vulnerability in the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrar...

The vulnerability of Zyxel 5G NR/4G LTE CPE router’s micro-programming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of Zyxel 5G NR/4G LTE CPE routers’ microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using a speciall...

Aremis 4 Nomad 授权问题漏洞

Aremis 4 Nomad A4N is an application from Aremis, Inc. A security vulnerability exists in Aremis 4 Nomad version 1.5.0. An attacker exploits the vulnerability to send a simple HTTP request to the correct endpoint and gain authorization to retrieve application data...

plugin: CSRF vulnerability in Script Security Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Script Security Plugin 1158.v7c1b73a69a08 and earlier allows attackers to have Jenkins send an HTTP request to an attacker-specified webserver...

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script located at /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a...

The vulnerability in the implementation of HTTP request processing functions of Zyxel switch microprogramming systems series GS1350, GS1915, GS1920, GS2220 allows a perpetrator to cause service interruptions.

The vulnerability of the HTTP request processing function implemented in Zyxel switch microprogramming devices of the GS1350, GS1915, GS1920, and GS2220 series is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow attackers to cause service failures...

CVE-2022-39952

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. An operating system command injection...

Fortinet FortiWeb 路径遍历漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A path traversal vulnerability exists that...