The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2024-50371 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default edgserver service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the wlan_scan operation. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50370 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by remote unauthenticated users capable of interacting with the default edgserver service enabled on the access point and malicious commands are executed with root privileges. No authentication is enabled on the service and the source of the vulnerability resides in processing code associated to the cfg_cmd_set_eth_conf operation. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50369 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the multiple_ssid_htm API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50368 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the basic_htm API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50367 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the sta_log_htm API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50366 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the applications_apply API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50365 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the lan_apply API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50364 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the export_log API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50363 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the mp_apply API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50362 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the connection_profile_apply API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50361 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the certificate_file_remove API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50360 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the snmp_apply API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50359 | A CWE-78 Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\') was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The source of the vulnerability relies on multiple parameters belonging to the scan_ap API which are not properly sanitized before being concatenated to OS level commands. | -- | Nov 26, 2024 | n/a |
| CVE-2024-50358 | A CWE-15 External Control of System or Configuration Setting was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<= v1.6.3) and EKI-6333AC-1GPO (<= v1.2.1). The vulnerability can be exploited by authenticated users by restoring a tampered configuration backup. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49597 | Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49596 | Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and arbitrary file deletion | -- | Nov 26, 2024 | n/a |
| CVE-2024-49595 | Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49353 | IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, which might lead to unexpected states, possibly resulting in a crash. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49351 | IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49053 | Microsoft Dynamics 365 Sales Spoofing Vulnerability | -- | Nov 26, 2024 | n/a |
| CVE-2024-49052 | Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49038 | Improper neutralization of input during web page generation (\'Cross-site Scripting\') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network. | -- | Nov 26, 2024 | n/a |
| CVE-2024-49035 | An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network. | -- | Nov 26, 2024 | n/a |
| CVE-2024-47257 | Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device becoming unavailable in the network. Axis has released patched AXIS OS versions for the highlighted flaw for products that are still under AXIS OS software support. Please refer to the Axis security advisory for more information and solution. | -- | Nov 26, 2024 | n/a |
| CVE-2024-47250 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI event and thus bogus GAP \'device found\' events being sent. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. | -- | Nov 26, 2024 | n/a |
| CVE-2024-47249 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. | -- | Nov 26, 2024 | n/a |
| CVE-2024-47248 | Buffer Copy without Checking Size of Input (\'Classic Buffer Overflow\') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. | -- | Nov 26, 2024 | n/a |
| CVE-2024-45755 | An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x before 23.04.3, and 22.10.x before 22.10.2. SQL injection can occur in the form to configure Centreon DSM slots. Exploitation is only accessible to authenticated users with high-privileged access. | -- | Nov 26, 2024 | n/a |
| CVE-2024-43784 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user\'s credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames. | -- | Nov 26, 2024 | n/a |
| CVE-2024-38834 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | -- | Nov 26, 2024 | n/a |
| CVE-2024-38833 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | -- | Nov 26, 2024 | n/a |
| CVE-2024-38832 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | -- | Nov 26, 2024 | n/a |
| CVE-2024-38831 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria Operations. | -- | Nov 26, 2024 | n/a |
| CVE-2024-38830 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations. | -- | Nov 26, 2024 | n/a |
| CVE-2024-36463 | The implementation of atob in Zabbix JS allows to create a string with arbitrary content and use it to access internal properties of objects. | -- | Nov 26, 2024 | n/a |
| CVE-2024-36254 | Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition. | -- | Nov 26, 2024 | n/a |
| CVE-2024-36251 | The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-36249 | Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-36248 | API keys for some cloud services are hardcoded in the main binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-35244 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-35160 | IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration. | -- | Nov 26, 2024 | n/a |
| CVE-2024-34162 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to SIMPLE, the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-33616 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-33610 | sessionlist.html and sys_trayentryreboot.html are accessible with no authentication. sessionlist.html provides logged-in users\' session information including session cookies, and sys_trayentryreboot.html allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-33605 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-32965 | Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability. | -- | Nov 26, 2024 | n/a |
| CVE-2024-32151 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-29978 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-29146 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
| CVE-2024-28955 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]. | -- | Nov 26, 2024 | n/a |
