Monthly
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbitrary code on remote Windows systems running the same software via UDP communication channels. This is an incomplete-fix bypass of CVE-2024-41726, reported by JPCERT/CC, meaning the original remediation failed to neutralize all traversal variants. No public exploit has been identified at time of analysis, but the subsequent-system impact is maximal (SC:H/SI:H/SA:H per CVSS 4.0), indicating full lateral compromise potential within enterprise environments deploying these management agents.
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.
Authenticated remote code execution affects the Riello UPS NetMan 208 Application before version 1.12, where the cgi-bin/certsupload.cgi certificate-upload handler fails to neutralize '/../' directory-traversal sequences in the supplied path, allowing a file to be written outside the intended certificate directory and subsequently executed. Exploitation requires valid high-privilege credentials on the network-reachable web management interface (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the practical exposure is limited to environments where such credentials exist, such as shared technician logins or reused defaults. Publicly available exploit code exists (published in the gerico-lab GitHub advisory set), but there is no CISA KEV confirmation of active exploitation, making this a moderate-but-real risk rather than a top-tier emergency.
Denial of service in the office service of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to make the service unavailable, requiring an existing on-device foothold such as a malicious low-privileged application. The vulnerability is not remotely exploitable and impacts only availability, with no effect on confidentiality or integrity. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.11%, 1st percentile), indicating minimal real-world urgency.
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.1.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbitrary code on remote Windows systems running the same software via UDP communication channels. This is an incomplete-fix bypass of CVE-2024-41726, reported by JPCERT/CC, meaning the original remediation failed to neutralize all traversal variants. No public exploit has been identified at time of analysis, but the subsequent-system impact is maximal (SC:H/SI:H/SA:H per CVSS 4.0), indicating full lateral compromise potential within enterprise environments deploying these management agents.
Swing Music is a self-hosted music player for local audio files. versions up to 2.1.4 contains a security vulnerability.
Authenticated remote code execution affects the Riello UPS NetMan 208 Application before version 1.12, where the cgi-bin/certsupload.cgi certificate-upload handler fails to neutralize '/../' directory-traversal sequences in the supplied path, allowing a file to be written outside the intended certificate directory and subsequently executed. Exploitation requires valid high-privilege credentials on the network-reachable web management interface (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so the practical exposure is limited to environments where such credentials exist, such as shared technician logins or reused defaults. Publicly available exploit code exists (published in the gerico-lab GitHub advisory set), but there is no CISA KEV confirmation of active exploitation, making this a moderate-but-real risk rather than a top-tier emergency.
Denial of service in the office service of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to make the service unavailable, requiring an existing on-device foothold such as a malicious low-privileged application. The vulnerability is not remotely exploitable and impacts only availability, with no effect on confidentiality or integrity. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.11%, 1st percentile), indicating minimal real-world urgency.
Franklin Fueling System EVO 550 and EVO 5000 are vulnerable to a Path Traversal vulnerability that could allow an attacker to access sensitive files on the system. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal: '/../filedir' vulnerability in Biges Safe Life Technologies Electronics Inc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.1.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.