CVE-2024-45276

Summary: CVE-2024-45276 permits an unauthenticated remote attacker to read files in the "/tmp" directory due to missing authentication. Connected sources identify affected hardware as Helmholz MB connect line / REX100 wireless router, with public records noting versions prior to 2.3.1 are impacte...

Joomla API Improper Access Checks

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Joomla API Improper Access Checks', 'Description' = %q Joomla versions between 4.0.0 and 4.2.7, inclusive, contain an improper API access...

SAP Unauthenticated WebService User Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Unauthenticated WebService User Creation', 'Description' = %q This module leverages an unauthenticated web service to submit a job which will...

CVE-2024-29736 Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

CVE-2023-41223

D-Link DIR-3040 prog.cgi SetQuickVPNSettings PSK Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is required to exploit this...

CVE-2024-1104

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

CVE-2024-1104

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

Design/Logic Flaw

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

CVE-2024-1104 Temporary denial of service during a brute force attack

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

CVE-2024-1104

CVE-2024-1104 affects AREAL Topkapi security platform, specifically Webserv2. The vulnerability arises from a bypass of the brute-force protection mechanism, enabling an unauthenticated remote attacker to disturb the webservice for all users. Reports from multiple sources (Topkapi-related CVE ent...

CVE-2024-1104 Temporary denial of service during a brute force attack

An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users...

PT-2024-16722 · Areal Topkapi · Webserv2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An unauthenticated remote attacker can bypass the brute force prevention mechanism and disturb the webservice for all users. Recommendations: At the...

Joomla! Improper Access Control Vulnerability

Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints...

Exploit for Improper Access Control in Joomla Joomla\!

CVE-2023-23752 - Joomla Improper Access Check An issue has be...

Metasploit Weekly Wrap-Up

Possible Web Service Removal Metasploit has support for running with a local database, or from a remote web service which can be initialized with msfdb init --component webservice. Future versions of Metasploit Framework may remove the msfdb remote webservice. Users that leverage this functionali...

CVE-2023-45355

Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as...

CVE-2023-45355

Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as...

CVE-2023-45355

Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as...

CVE-2023-45355

Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command injection by an authenticated attacker into the platform operating system, leading to administrative access via the webservice. This is also known as...

CVE-2023-29473

webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23710...