Whatsup Gold, Observium and Offis vulnerabilities

Summary: Cisco Talos disclosed three vulnerabilities in Observium, three in Offis DCMTK, and four in WhatsUp Gold, all of which have been patched by their respective vendors. The Observium flaws are two cross-site scripting and one HTML injection triggered by an authenticated user clicking a crafted link, the DCMTK flaws include an incorrect type conversion leading to arbitrary code execution and two improper array index validations leading to out-of-bounds writes triggered by malicious DICOM files, and the WhatsUp Gold flaws include information disclosure via authenticated HTTP requests plus sensitive information disclosure and denial of service via unauthenticated HTTP requests.
Bottom line: Two of the WhatsUp Gold vulnerabilities, including a sensitive information disclosure and a denial of service, can be triggered by an unauthenticated HTTP request, meaning an attacker needs no credentials to reach an IT infrastructure management product.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-12105 CVE-2024-28130 CVE-2024-47796 CVE-2024-5010 CVE-2024-5011 CVE-2024-5017 CVE-2024-52333
Related: Vulnerabilities in employee management system could lead to remote code execution, login credential theft Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026