Semaine du 2 décembre au 8 décembre 2024

CyberPersons CyberPanel

CyberPanel Incorrect Default Permissions Vulnerability — CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.

ProjectSend ProjectSend

ProjectSend Improper Authentication Vulnerability — ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Zyxel Multiple Firewalls

Zyxel Multiple Firewalls Path Traversal Vulnerability — Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.

North Grid Proself

North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability — North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.