Fortinet Fortigate Path traversal in execute command (FG-IR-22-369)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-369 advisory. - A improper limitation of a pathname to a restricted directory vulnerability 'path traversal' CWE-22 in Fortinet FortiOS...

Exploit for Use of Hard-coded Credentials in Dlink Dns-320L_Firmware

Dinkleberry 🫐 Are you one of the 92,000+ people1 stuck with a...

OpenBD 安全漏洞

OpenBD is a truly open source and free GPLv3.0 Java CFML runtime from OpenBD Open Source. A security vulnerability exists in OpenBD version 20210306203917-6cbe797, which stems from vulnerability to untrusted data deserialization, and can be exploited by an attacker to execute arbitrary code on th...

CVE-2024-27260

CVE-2024-27260 : IBM AIX and VIOS are affected by a vulnerability in the invscout command that could allow a non-privileged local user to execute arbitrary commands. Affected products/versions: AIX 7.2 and 7.3; VIOS 3.1 and 4.1 (invscout.rte 2.2.0.0–2.2.0.26). Root cause is the invscout component...

PT-2024-30422

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions up to 9.3 Description A vulnerability allows remote attackers to execute arbitrary code due to insufficient protection of the "/apply settings" and "/execute code" endpoints. Attackers can bypass protections by...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to 9.3, which stems from insufficient protection of the /applysettings and /executecode endpoints, allowing remote attackers to execute...

Adobe Acrobat Reader DC Continuous Security Update (APSB24-07) - Mac OS X

Adobe Acrobat Reader DC Continuous is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-4947

The CVE-2024-4947 entry corresponds to a Type Confusion vulnerability in Google Chrome/Chromium V8 that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Affected software is the Chrome/Chromium stack using V8 prior to version 125.0.6422.60. The root c...

CVE-2024-34909

An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34909

An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34906

The CVE-2024-34906 entry concerns an arbitrary file upload vulnerability in dootask v0.30.13 that allows an attacker to execute arbitrary code by uploading a crafted PDF file. The connected documents corroborate a PDF-based upload flaw affecting dootask 0.30.13, enabling code execution upon succe...

Microsoft Windows Multiple Vulnerabilities (KB5037788)

This host is missing a critical security update according to Microsoft KB5037788 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-33277

Name of the Vulnerable Software and Affected Versions DigiWin EasyFlow .NET affected versions not specified Description The issue is related to a lack of validation for certain input parameters, which allows remote attackers to inject arbitrary SQL commands. This enables unauthorized access to...

Dell PowerScale OneFS Execute Unnecessary Privileges Vulnerability

Dell PowerScale OneFS is a proprietary operating system developed by Dell for its PowerScale horizontally scalable NAS network attached storage solution. Dell PowerScale OneFS is vulnerable to an Execute Unnecessary Privilege vulnerability, which could be exploited by an attacker to cause an...

CVE-2024-3044

Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted...

CVE-2024-4413

The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugi...

CVE-2024-31803

Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT::readpredata128fromfile function...

CVE-2024-22267

CVE-2024-22267 affects VMware Workstation and Fusion. A use-after-free in the vbluetooth device can allow a malicious actor with local privileges inside a VM to execute code in the host VMX process. The issue is documented with high/severe impact (confidentiality/integrity/availability at risk). ...

CVE-2024-22267

VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host...

CVE-2024-3459: Improper Protection of Alternate Path

KioWare for Windows versions all through 8.34 allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently,...