KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation of the device. This vulnerability involves extracting the connection confirmation code remotely, bypassing the need to obtain it directly from the physical screen.
In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 can be exploited to achieve local code execution at the root level.
HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.
Данная статья является сборником кратких и субъективных мини обзоров четырнадцати докладов, представленных в этом году на конференции PyCon Russia 2023 в зоне Python. Сразу хочу заметить, что я не ставил цель в точности воспроизвести тексты или содержание выступлений спикеров, а скорее…
A command injection vulnerability in the component diag_backup.php of OPNsense before 23.7 allows attackers to execute arbitrary commands via a crafted backup configuration file.
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
OPNsense before 23.7 was discovered to contain insecure permissions in the directory /tmp.
Insecure permissions in the configuration directory (/conf/) of OPNsense before 23.7 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
Insecure permissions exist for configd.socket in OPNsense before 23.7.
The Crash Reporter (crash_reporter.php) component of OPNsense before 23.7 mishandles input sanitization.