🚨 CVE-2024-38289
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
🎖@cveNotify
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
🎖@cveNotify
GitHub
TurboMeeting: Boolean-based SQL Injection
### Summary
A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the da...
A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the da...
🚨 CVE-2024-42520
TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.
🎖@cveNotify
TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.
🎖@cveNotify
GitHub
GitHub - c10uds/totolink_A3002R_stackoverflow
Contribute to c10uds/totolink_A3002R_stackoverflow development by creating an account on GitHub.
🚨 CVE-2024-42628
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
🎖@cveNotify
GitHub
cms/5/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42630
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
🎖@cveNotify
GitHub
cms/10/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42631
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
🎖@cveNotify
GitHub
cms/7/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42632
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
🎖@cveNotify
GitHub
cms/1/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42623
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
🎖@cveNotify
GitHub
cms/8/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42624
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
🎖@cveNotify
GitHub
cms/3/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42626
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
🎖@cveNotify
GitHub
cms/4/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42627
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
🎖@cveNotify
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
🎖@cveNotify
GitHub
cms/6/readme.md at main · Kirtoc/cms
Contribute to Kirtoc/cms development by creating an account on GitHub.
🚨 CVE-2024-42543
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
🎖@cveNotify
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
🎖@cveNotify
🚨 CVE-2024-42545
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.
🎖@cveNotify
TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.
🎖@cveNotify
GitHub
IoT-vulnerable/TOTOLINK/A3700R/setWizardCfg.md at main · abcdefg-png/IoT-vulnerable
IoT-vulnerable. Contribute to abcdefg-png/IoT-vulnerable development by creating an account on GitHub.
🚨 CVE-2024-38501
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
🎖@cveNotify
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
🎖@cveNotify
Certvde
PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial…
🚨 CVE-2024-38502
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.
🎖@cveNotify
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.
🎖@cveNotify
Certvde
PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial…
🚨 CVE-2024-3913
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
🎖@cveNotify
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
🎖@cveNotify
Certvde
Phoenix Contact: Security Advisory for CHARX-SEC3xxx Charge controllers
🚨 CVE-2024-5849
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
🎖@cveNotify
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
🎖@cveNotify
Certvde
PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial…
🚨 CVE-2024-41808
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available.
🎖@cveNotify
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. It has been noted that the front-end uses `DOMPurify` or Vue templating to escape cross-site scripting (XSS) extensively, however certain areas of the front end lack this XSS protection. When combining the missing protection with the insecure authentication handling that the front-end uses, a malicious user may be able to take over any victim's account provided they meet the exploitation steps. As of time of publication, no patched version is available.
🎖@cveNotify
GitHub
Stored XSS may lead to complete account takeover
## Details
_Discussions about the issue being disclosed, the underlying behaviour at fault, etc_
The OpenObserve platform provides the ability to filter logs in a dashboard by the values upload...
_Discussions about the issue being disclosed, the underlying behaviour at fault, etc_
The OpenObserve platform provides the ability to filter logs in a dashboard by the values upload...
🚨 CVE-2024-6558
HMS Industrial Networks
Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks.
🎖@cveNotify
HMS Industrial Networks
Anybus-CompactCom 30 products are vulnerable to a XSS attack caused by the lack of input sanitation checks. As a consequence, it is possible to insert HTML code into input fields and store the HTML code. The stored HTML code will be embedded in the page and executed by host browser the next time the page is loaded, enabling social engineering attacks.
🎖@cveNotify
🚨 CVE-2024-41809
OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.
🎖@cveNotify
OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, OpenObserve contains a cross-site scripting vulnerability in line 32 of `openobserve/web/src/views/MemberSubscription.vue`. Version 0.10.0 sanitizes incoming html.
🎖@cveNotify
GitHub
openobserve/web/src/views/MemberSubscription.vue at v0.5.2 · openobserve/openobserve
OpenObserve is an open-source observability platform for logs, metrics, traces, and frontend monitoring. A cost-effective alternative to Datadog, Splunk, and Elasticsearch with 140x lower storage c...
🚨 CVE-2024-7120
A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
🎖@cveNotify
A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.
🎖@cveNotify
netsecfish on Notion
Command Injection Vulnerability in RAISECOM Gateway Devices | Notion
Overview