Aggregator

A vulnerability classified as problematic has been found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38. Affected is an unknown function of the file dynamic_script.cgi of the component URL Handler. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-42061. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Zyxel VMG8825-T50K 5.50(ABOM.8)C0. It has been rated as critical. This issue affects some unknown processing in the library libclinkc of the component HTTP Request Handler. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2024-5412. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38. It has been declared as critical. This vulnerability affects unknown code of the component HTTP Request Handler. The manipulation leads to buffer overflow. This vulnerability was named CVE-2024-6343. The attack can be initiated remotely. There is no exploit available.

浅谈 Bun 内部shell注入

Windows 权限维持

金和oaGeneralXmlhttpPage.apx SQL注入漏洞和UploadFileEditorSave.aspx任意文件上传漏洞分析

BaseCTF新生赛web week2解题wp

A vulnerability was found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38. It has been classified as critical. This affects an unknown part. The manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2024-42060. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38 and classified as critical. Affected by this issue is some unknown functionality of the component FTP. The manipulation leads to os command injection. This vulnerability is handled as CVE-2024-42059. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Packets Handler. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2024-42058. The attack can be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Zyxel ATP, USG FLEX, USG FLEX 50(W) and USG20(W)-VPN up to 5.38. Affected is an unknown function of the component IPSec VPN. The manipulation of the argument username leads to os command injection. This vulnerability is traded as CVE-2024-42057. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as very critical, has been found in Zyxel NWA1123ACv3, WAC500, WAX655E, WBE530 and USG LITE 60AX. This issue affects some unknown processing of the component Cookie Handler. The manipulation of the argument host leads to os command injection. The identification of this vulnerability is CVE-2024-7261. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical was found in Zyxel ATP and USG FLEX up to 5.38. This vulnerability affects unknown code of the component CLI. The manipulation leads to os command injection. This vulnerability was named CVE-2024-7203. The attack can be initiated remotely. There is no exploit available.

A vulnerability has been found in Adobe Acrobat Reader up to 11.0.22/2015.006.30355/2017.011.30066/2017.012.20098 and classified as critical. This vulnerability affects unknown code. The manipulation leads to memory corruption. This vulnerability was named CVE-2017-16368. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in YaBB SE 1.5.1. It has been classified as critical. Affected is an unknown function of the file News.php. The manipulation of the argument template leads to code injection. This vulnerability is traded as CVE-2000-1176. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in SGI IRIX up to 6.4. This affects an unknown part of the component startmidi. The manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-1999-0959. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

根据 Valve 公布的 2024 年 8 月 Steam 硬件和软件调查报告，随着 Windows 10 的寿命接近终点，Windows 11 占有率（49.17%）超过 Windows 10（47.09%），成为最流行的 PC 游戏操作系统。Windows 11 的份额增加了 3.36%，而 Windows 10 减少了 3.07%。 macOS 和 Linux 的份额变化甚微，分别占 1.30% 和 1.92%。此外简体中文再次超过英语成为 Steam 用户使用最多的语言，这可能与最近发布的热门游戏有关：简体中文占 35.03%，增加 3.05%；英语 31.17% 减少 2.89%；俄语 8.49%。

A vulnerability was found in WordPress 2.1/2.1.1/2.1.2. It has been rated as critical. This issue affects some unknown processing of the file xmlrpc.php. The manipulation of the argument post_id leads to sql injection. The identification of this vulnerability is CVE-2007-1897. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in 2G Live Tv 0.9 and classified as critical. This vulnerability affects unknown code of the component X.509 Certificate Handler. The manipulation leads to cryptographic issues. This vulnerability was named CVE-2014-5842. Access to the local network is required for this attack to succeed. There is no exploit available.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Bobby Gould of Trend Micro Zero Day Initiative' was reported to the affected vendor on: 2024-09-03, 63 days ago. The vendor is given until 2025-01-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.