Monthly
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacker to execute arbitrary OS commands and escalate privileges to root on affected Cisco UCS Standalone servers. Exploitation requires only low-level credentials to the IMC web-based management interface - no local access, no user interaction. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and full system impact make it a meaningful priority for any environment with IMC exposed to internal or management networks.
Cookie attribute injection in elixir-plug's Plug library allows a remote attacker who can supply values reflected into `Set-Cookie` headers to inject the `;` delimiter and override attributes such as `Domain`, `Path`, `Secure`, and `HttpOnly`. Applications calling `Plug.Conn.put_resp_cookie/4` with user-controlled data - for example, reflecting a username or preference value - are exposed to session fixation and cookie tossing across five supported release lines (0.1.0 through 1.20.2). No public exploit code or CISA KEV listing is present at time of analysis, but the attack is mechanically straightforward wherever the vulnerable code pattern exists.
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.
SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions <. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability has been identified in SICAM T (All versions < V3.0). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Command injection in Cisco Integrated Management Controller (IMC) allows a remotely authenticated low-privileged attacker to execute arbitrary OS commands and escalate privileges to root on affected Cisco UCS Standalone servers. Exploitation requires only low-level credentials to the IMC web-based management interface - no local access, no user interaction. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and full system impact make it a meaningful priority for any environment with IMC exposed to internal or management networks.
Cookie attribute injection in elixir-plug's Plug library allows a remote attacker who can supply values reflected into `Set-Cookie` headers to inject the `;` delimiter and override attributes such as `Domain`, `Path`, `Secure`, and `HttpOnly`. Applications calling `Plug.Conn.put_resp_cookie/4` with user-controlled data - for example, reflecting a username or preference value - are exposed to session fixation and cookie tossing across five supported release lines (0.1.0 through 1.20.2). No public exploit code or CISA KEV listing is present at time of analysis, but the attack is mechanically straightforward wherever the vulnerable code pattern exists.
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating. Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity. No vendor patch available.
SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.10), SICAM P850 (7KG8500-0AA10-0AA0) (All versions <. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A vulnerability has been identified in SICAM T (All versions < V3.0). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in SICAM T (All versions < V3.0). Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity.