2024

EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse speci

EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remot

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulner

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, all

EC-WEB FS-EZViewer(Web)'s query functionality lacks proper restrictions of user input, allowing remote attackers authent

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm cli

Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allo

4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardle

A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might al

Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which

Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which

An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Sec

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the S

An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass S

An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker t

Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configur

Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into

A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.

An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create n

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger o

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can

Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.

A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML v

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds write ex

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS so

An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enable

Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, maki

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker p

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker p

When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly autho

When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traf

When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Tr

When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is co

When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Applianc

Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility an

A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read fil

An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software v

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management M

When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, un

A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files.  Note: S

When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iContro

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed tra

When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an i

BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but d

For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic agai

When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclose