The vulnerability of the SetSysEmailSettings() function in D-Link DIR-3040 wireless router software allows a hacker to execute arbitrary code.

The vulnerability of the SetSysEmailSettings function in D-Link DIR-3040 wireless router software lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HNAP requests ...

CVE-2023-43697

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

CVE-2023-5101

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...

CVE-2023-5102

Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests...

Splunk 9.0.5 - admin account take over

!/usr/bin/env python3 Exploit Title: Splunk 9.0.5 - admin account take over Author: Redway Security Discovery: Santiago Lopez CVE: CVE-2023-32707 Vendor Description: A low-privilege user who holds a role that has the edituser capability assigned to it can escalate their privileges to that of the...

CVE-2023-44860

An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request...

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager (formerly Cisco SD-WAN vManage) centralized network management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Elasticsearch search system in the Cisco Catalyst SD-WAN Manager formerly Cisco SD-WAN vManage centralized network management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protecte...

The vulnerability lies in the cropImage function of the software tool for creating and distributing content with LG Simple Editor. This function allows a malicious user to delete any files they desire.

The vulnerability of the cropImage function in the software for creating and distributing content with LG Simple Editor arises due to a typing error during the processing of command-line arguments that handle directory traversal. Exploiting this vulnerability allows an attacker to send specially...

CVE-2023-43323

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...

The vulnerability of the Qlik Sense Enterprise data analysis platform, related to insufficient validation of input data, allows a perpetrator to send arbitrary HTTP requests.

The vulnerability of the Qlik Sense Enterprise data analysis platform is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to send arbitrary HTTP requests remotely...

CVE-2022-47559

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

CVE-2022-47559

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

Code injection

UNSUPPPORTED WHEN ASSIGNED Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

CVE-2022-47556

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

CVE-2022-47559 Cross-Site Request Forgery in Ormazabal products

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

CVE-2022-47559

CVE-2022-47559 affects Ormazabal ekorCCP and ekorRCI with a lack of device control over web requests, enabling an attacker to craft requests that can execute malicious actions when a logged-in user is targeted. The vulnerability is described as a Cross‑Site Request Forgery (CSRF) issue impacting ...

CVE-2022-47559 Cross-Site Request Forgery in Ormazabal products

Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

CVE-2022-47556 Uncontrolled Resource Consumption in Ormazabal products

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

Mastodon Code Issue Vulnerability

Mastodon is an open source social network server based on ActivityPub. A code issue vulnerability exists in Mastodon versions 4.2.0-beta1 through 4.2.0-rc2, which can be exploited by an attacker to inject arbitrary data into HTTP requests sent by Mastodon by crafting specific inputs...

The vulnerability of the FortiSIEM security management system, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the FortiSIEM security management system is related to insufficient protection of operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by sending specially crafted HTTP requests...