Apache HugeGraph-Server Improper Access Control Vulnerability

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code...

K000141090: SQLite vulnerability CVE-2020-13630

Security Advisory Description ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. CVE-2020-13630 Impact When this vulnerability is exploited, an attacker can cause SQLite to crash, resulting in a denial-of-service DoS, or possibly execu...

Adobe Acrobat Reader DC Continuous Security Update (APSB24-70) - Windows

Adobe Acrobat Reader DC Continuous is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Contao 代码问题漏洞

Contao is an open source Content Management System CMS developed in PHP by Contao Open Source. The system supports search engines, rights management, and CSS frameworks. A code issue vulnerability exists in Contao 4.0.0 and prior versions, which originates from a backend user with file manager...

CVE-2024-45695

CVE-2024-45695 affects D-Link DIR-X4860 wireless routers. The web service exposes a stack-based buffer overflow in unauthenticated context, enabling remote code execution. Public sources confirm the DIR-X4860 as affected and describe the root cause as a stack-based overflow in the device’s web se...

Windows Escalate UAC Execute RunAs Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Escalate UAC Execute RunAs', 'Description' = %q This module will attempt to elevate execution level using the ShellExecute undocumented...

CVE-2024-45105

Summary: CVE-2024-45105 describes a UEFI SMM callout vulnerability affecting Lenovo ThinkSystem servers. The issue could allow a local attacker with elevated privileges to execute arbitrary code via a SMM callout. The CVSS vectors indicate local access, low attack complexity, but required high pr...

CVE-2024-3100

Technical details about CVE-2024-3100 are not publicly available in the provided documents. Monitor for updates from official sources.

Vulnerabilities fixed in Citrix Workspace App for Windows

Citrix has fixed vulnerabilities in the Citrix Workspace App for Windows. A local malicious person could exploit the vulnerabilities to grant themselves elevated privileges and potentially execute code with SYSTEM privileges. Citrix has released updates to fix the vulnerabilities. See attached...

PYSEC-2024-83

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB version 23.10.2.0 and earlier, which stems from the presence of deserialization of untrusted data, allowing a maliciously uploaded model to run arbitrary code on the server when...

Microsoft Excel Elevation of Privilege Vulnerability (CNVD-2024-42948)

Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An elevation of privilege vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code with elevated privileges...

PT-2024-31811 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 and newer Description: The issue is related to the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded 'inhouse' model to run arbitrary code on the server when a 'describe'...

Ubuntu: Security Advisory (USN-6998-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Microsoft SQL Server

Microsoft has fixed vulnerabilities in SQL Server. Most of the vulnerabilities are in SQL Native Scoring and allow a malicious person to assign themselves elevated privileges, access sensitive data and execute arbitrary code within the SQL Server. Successful exploitation requires the malicious...

CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...

Security Bulletin: Vulnerabilities in shim library (CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40549, CVE-2023-40550, CVE-2023-40551) affect Power HMC.

Summary The shim library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-40546 DESCRIPTION: rhboot shim is vulnerable to a denial of service, caused by a NULL pointer dereference f;aw in the mirroroneesl function in...

CVE-2024-33698

A vulnerability has been identified in Opcenter Quality All versions V2406, Opcenter RDnL All versions V2410, SIMATIC PCS neo V4.0 All versions, SIMATIC PCS neo V4.1 All versions V4.1 Update 2, SIMATIC PCS neo V5.0 All versions V5.0 Update 1, SINEC NMS All versions, SINEMA Remote Connect Client A...

CVE-2024-6596

An unauthenticated remote attacker can run malicious c code included in curve files and execute commands in the users context...

CVE-2024-6596

CVE-2024-6596 concerns Endress+Hauser products (notably Echo Curve Viewer and related Curve functionality). The connected sources describe an unauthenticated remote attacker who can run malicious C# code contained in curve files and thereby execute commands in the user’s context, enabling remote ...