The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.

Specific endpoint with command injection vulnerability in Digiever DS-2105 Pro, attacker can trigger this vulnerability by crafted HTTP request and lead remote code execution.

An XML External Entity Injection vulnerability has been reported in Adobe Commerce and Magento. The vulnerability is due to improper validation of user data sent through multiple API endpoints. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation could result in the disclosure of information from the target server's filesystem.

A stored cross-site scripting vulnerability has been reported in Roundcube Webmail. The vulnerability is due to insufficient validation and sanitization of the animate HTML tag within the SVG tag. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted email message to a target user. When the user accesses the Roundcube server to view the crafted email, the XSS condition will be triggered, depending on the payload, immediately after viewing or after clicking the malicious element. Successful exploitation could result in the execution of script code in security context of the target user's browser.

Threat Encyclopedia

1233917

ICS Rockwell 1756 Incorrect Authorization -1 (CVE-2010-2965)

High

2024/12/27

1233322

WEB Digiever DS-2105 Pro Command Injection

High

2024/12/27

1235441

WEB Adobe Commerce and Magento_createFromArray XML External Entity Injection -3 (CVE-2024-34102)

Critical

2024/12/26

1235548

SMTP Roundcube Webmail SVG animate Stored Cross-Site Scripting -1 (CVE-2024-37383)

Medium

2024/12/26