CVE-2024-24594

A cross-site scripting XSS vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI...

CVE-2024-20348

A vulnerability in the Out-of-Band OOB Plug and Play PnP feature of Cisco Nexus Dashboard Fabric Controller NDFC could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this...

CVE-2024-8232

SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication...

CVE-2024-9644 Four-Faith F3x36 bapply.cgi Auth Bypass

The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the normal "apply.cgi" endpoint. A remote...

CVE-2024-35144

IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system...

CVE-2024-35144 IBM Maximo Application Suite information disclosure

IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system...

CVE-2024-35144

The CVE-2024-35144 case affects IBM Maximo Application Suite Monitor Component (versions 8.10, 8.11, 9.0). Description: the Monitor Component stores source code on the web server, creating potential disclosure of sensitive information (CWE-540). Impact is information disclosure that could aid fur...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat

CVE-2024-50379-Exploit This repository provides a Python scri...

CVE-2024-26154 ETIC Telecom Remote Access Server (RAS) Cross-site Scripting

All versions of ETIC Telecom Remote Access Server RAS prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and then presents it to the administrators in a few different pages...

Zenitel AlphaWeb XE 安全漏洞

Zenitel AlphaWeb XE is an embedded web server from Zenitel running on AlphaCom XE. A security vulnerability exists in Zenitel AlphaWeb XE version v11.2.3.10. An attacker can exploit the vulnerability to read arbitrary files on the application service...

/sbin/httpd system DAP-2555 DoS

The vulnerability of the /sbin/httpd microprogramming system used by D-Link DAP-2555 wireless access points is related to the escape of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending specially crafted HTTP...

CVE-2021-32007 Missing security header: Referrer-Policy URL

This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Secomea GateManager to potentially leak information to remote servers...

SINEC Traffic Analyzer Information Disclosure

The vulnerability of the web server of the monitoring and network traffic analysis software in industrial networks, SINEC Traffic Analyzer, is related to improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to gain access to confidential...

CVE-2024-11215

Absolute path traversal incorrect restriction of a path to a restricted directory vulnerability in the EasyPHP web server, affecting version 14.1. This vulnerability could allow remote users to bypass SecurityManager restrictions and retrieve any file stored on the server by setting only...

Siemens OZW devices (web servers) cross-site scripting vulnerability

OZW devices web servers are used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning. A cross-site scripting vulnerability exists in Siemens OZW devices web servers, which can be exploited by an attacker to inject arbitrary JavaScript code...

CVE-2024-51788 WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through 4.3.0...

CVE-2024-51792 WordPress Audio Record plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record audio-record allows Upload a Web Shell to a Web Server.This issue affects Audio Record: from n/a through = 1.0...

PT-2024-34386 · Trendnet · Trendnet Tew-820Ap

Name of the Vulnerable Software and Affected Versions: Trendnet TEW-820AP version 1.01.B01 Description: The issue is related to a stack overflow vulnerability in the boa httpd. Specifically, the vulnerability is found in the /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, and /boafrm/formDnsv6 API...

SIMATIC CP DoS

The vulnerability of the web server of the microprogramming software for communication modules of SIMATIC CP, TIM 1531 IRC, is related to errors in pointer assignment. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

SIMATICS7-1500 S7-1200 CPU Family URL Redirect

The vulnerability of the web server of the microprogramming software for programmable logic controllers SIMATICS7-1500 and S7-1200 CPUs is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows an attacker to remotely redirect users to arbitrary URL...