VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202402-1803 CVE-2023-45581 fortinet's  FortiClient EMS  Vulnerability in CVSS V2: -
CVSS V3: 7.2
Severity: HIGH
An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and before 7.0.10 allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests. fortinet's FortiClient EMS Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202402-1317 CVE-2024-23804 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted PSOBJ files. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202402-1318 CVE-2024-23803 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202402-1321 CVE-2024-23802 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds read vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds read vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202402-1325 CVE-2024-23801 Siemens'  Tecnomatix Plant Simulation  In  NULL  Pointer dereference vulnerability CVSS V2: -
CVSS V3: 5.5
Severity: MEDIUM
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Siemens' Tecnomatix Plant Simulation for, NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state
VAR-202402-1316 CVE-2024-23800 Siemens'  Tecnomatix Plant Simulation  In  NULL  Pointer dereference vulnerability CVSS V2: -
CVSS V3: 5.5
Severity: MEDIUM
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Siemens' Tecnomatix Plant Simulation for, NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state
VAR-202402-1320 CVE-2024-23799 Siemens'  Tecnomatix Plant Simulation  In  NULL  Pointer dereference vulnerability CVSS V2: -
CVSS V3: 5.5
Severity: MEDIUM
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Siemens' Tecnomatix Plant Simulation for, NULL There is a vulnerability in pointer dereference.Service operation interruption (DoS) It may be in a state
VAR-202402-1324 CVE-2024-23798 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer
VAR-202402-1322 CVE-2024-23797 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer
VAR-202402-1323 CVE-2024-23796 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer
VAR-202402-1319 CVE-2024-23795 Siemens'  Tecnomatix Plant Simulation  Out-of-bounds write vulnerability in CVSS V2: -
CVSS V3: 7.8
Severity: HIGH
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted WRL file. This could allow an attacker to execute code in the context of the current process. Siemens' Tecnomatix Plant Simulation Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Tecnomatix Plant Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WRL files
VAR-202402-1390 CVE-2023-48363 Null pointer dereference vulnerabilities in multiple Siemens products CVSS V2: 6.1
CVSS V3: 6.5
Severity: MEDIUM
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 SP4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain unorganized RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server. SIMATIC PCS 7 is a distributed control system (DCS) that integrates SIMATIC WinCC, SIMATIC Batch, SIMATIC Route control, OpenPCS 7 and other components. SIMATIC WinCC is a supervisory control and data acquisition (SCADA) system. SIMATIC WinCC Runtime Professional is a visual runtime platform for operator control and monitoring of machines and plants
VAR-202402-1248 CVE-2023-51440 Multiple Siemens product communication channel source verification error vulnerabilities CVSS V2: 7.8
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All versions), SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0) (All versions), SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0) (All versions). Affected products incorrectly validate TCP sequence numbers. This could allow an unauthenticated remote attacker to create a denial of service condition by injecting spoofed TCP RST packets. SIMATIC CP 343-1 is a communication processor (CP) that provides Ethernet communication for SIMATIC S7-300 cpu. SIPLUS extreme products are designed for reliable operation under extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS, SIMOTION, SCALANCE or other devices. SIPLUS devices use the same firmware as the product on which they are based
VAR-202402-1389 CVE-2023-48364 Null pointer dereference vulnerability (CNVD-2024-09314) in multiple Siemens products CVSS V2: 6.1
CVSS V3: 6.5
Severity: MEDIUM
A vulnerability has been identified in OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 15), SIMATIC WinCC V8.0 (All versions < V8.0 SP4). The implementation of the RPC (Remote Procedure call) communication protocol in the affected products do not properly handle certain malformed RPC messages. An attacker could use this vulnerability to cause a denial of service condition in the RPC server. SIMATIC PCS 7 is a distributed control system (DCS) that integrates SIMATIC WinCC, SIMATIC Batch, SIMATIC Route control, OpenPCS 7 and other components. SIMATIC WinCC is a supervisory control and data acquisition (SCADA) system. SIMATIC WinCC Runtime Professional is a visual runtime platform for operator control and monitoring of machines and plants
VAR-202402-1534 CVE-2024-21404 Microsoft's  .NET  and  Microsoft Visual Studio  Service operation interruption in  (DoS)  Vulnerability CVSS V2: -
CVSS V3: 7.5
Severity: HIGH
.NET Denial of Service Vulnerability. Microsoft's .NET and Microsoft Visual Studio includes denial of service (DoS) Vulnerability exists.Service operation interruption (DoS) It may be in a state. ========================================================================== Ubuntu Security Notice USN-6634-1 February 13, 2024 dotnet6, dotnet7, dotnet8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in .NET. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime - dotnet8: dotNET CLI tools and runtime Details: Brennan Conroy discovered that .NET with SignalR did not properly handle malicious clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21386) Bahaa Naamneh discovered that .NET with OpenSSL support did not properly parse X509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21404) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-host 6.0.127-0ubuntu1~23.10.1 dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1 dotnet6 6.0.127-0ubuntu1~23.10.1 dotnet7 7.0.116-0ubuntu1~23.10.1 dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1 Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-host 6.0.127-0ubuntu1~22.04.1 dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1 dotnet6 6.0.127-0ubuntu1~22.04.1 dotnet7 7.0.116-0ubuntu1~22.04.1 dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6634-1 CVE-2024-21386, CVE-2024-21404 Package Information: https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~23.10.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~23.10.1 https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~23.10.1 https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~22.04.1 https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~22.04.1 https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~22.04.1
VAR-202402-1535 CVE-2024-21386 Microsoft's  Microsoft Visual Studio  and  ASP.NET Core  Service operation interruption in  (DoS)  Vulnerability Stated CVSS V2: -
CVSS V3: 7.5
Severity: HIGH
.NET Denial of Service Vulnerability. Microsoft's Microsoft Visual Studio and ASP.NET Core for, .NET Service operation is interrupted due to a defect in (DoS) A state vulnerability exists.Service operation interruption (DoS) It may be in a state. The following advisory data is extracted from: https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_0814.json Red Hat officially shut down their mailing list notifications October 10, 2023. Due to this, Packet Storm has recreated the below data as a reference point to raise awareness. It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment. - Packet Storm Staff ==================================================================== Red Hat Security Advisory Synopsis: Important: .NET 6.0 security, bug fix, and enhancement update Advisory ID: RHSA-2024:0814-03 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2024:0814 Issue date: 2024-02-14 Revision: 03 CVE Names: CVE-2024-21386 ==================================================================== Summary: An update for .NET 6.0 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. The following packages have been upgraded to a later upstream version: rh-dotnet60-dotnet (6.0.127). (BZ#2262321) Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution: https://access.redhat.com/articles/11258 CVEs: CVE-2024-21386 References: https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=2263085 https://bugzilla.redhat.com/show_bug.cgi?id=2263086 . ========================================================================== Ubuntu Security Notice USN-6634-1 February 13, 2024 dotnet6, dotnet7, dotnet8 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in .NET. Software Description: - dotnet6: dotNET CLI tools and runtime - dotnet7: dotNET CLI tools and runtime - dotnet8: dotNET CLI tools and runtime Details: Brennan Conroy discovered that .NET with SignalR did not properly handle malicious clients. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21386) Bahaa Naamneh discovered that .NET with OpenSSL support did not properly parse X509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-21404) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-host 6.0.127-0ubuntu1~23.10.1 dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1 dotnet6 6.0.127-0ubuntu1~23.10.1 dotnet7 7.0.116-0ubuntu1~23.10.1 dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1 Ubuntu 22.04 LTS: aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1 aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1 aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-host 6.0.127-0ubuntu1~22.04.1 dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1 dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1 dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1 dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1 dotnet6 6.0.127-0ubuntu1~22.04.1 dotnet7 7.0.116-0ubuntu1~22.04.1 dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1 In general, a standard system update will make all the necessary changes
VAR-202402-0387 CVE-2024-1431 of netgear  R7000  Firmware vulnerabilities CVSS V2: 3.3
CVSS V3: 4.3
Severity: MEDIUM
A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file /debuginfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-253382 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Netgear R7000 is a Netgear dual-band Gigabit wireless router. A remote attacker can use this vulnerability to submit special requests and obtain sensitive information
VAR-202402-0401 CVE-2024-1430 of netgear  R7000  Firmware vulnerabilities CVSS V2: 3.3
CVSS V3: 4.3
Severity: MEDIUM
A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier VDB-253381 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
VAR-202402-0623 CVE-2024-24321 D-Link Systems, Inc.  of  DIR-816  Command injection vulnerability in firmware CVSS V2: -
CVSS V3: 9.8
Severity: CRITICAL
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function. D-Link Systems, Inc. of DIR-816 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202402-1506 CVE-2023-43017 IBM  of  Security Verify Access  Certificate validation vulnerabilities in CVSS V2: -
CVSS V3: 7.2
Severity: HIGH
IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force ID: 266155. (DoS) It may be in a state