CVE-2024-52579

Summary: CVE-2024-52579 in Misskey pertains to a Server-Side Request Forgery (SSRF) due to improper host checking in APIs using HttpRequestService. The vulnerability allows an attacker to make POST or GET requests to internal/private IPs, enabling attacks on internal servers. Affected versions: M...

PT-2024-18959 · Bun · Bun

Name of the Vulnerable Software and Affected Versions: bun versions prior to 1.1.30 Description: The issue is related to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. Recommendations: For versions prior t...

BIT-NODE-MIN-2023-32004

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using th...

CVE-2024-12642 Chunghwa Telecom TenderDocTransfer - Arbitrary File Write

TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs...

CVE-2024-12641

The CVE-2024-12641 entry describes TenderDocTransfer by Chunghwa Telecom as vulnerable to Reflected Cross-site Scripting due to missing CSRF protection on API endpoints. Unauthenticated remote attackers could use specific APIs via phishing to inject and execute arbitrary JavaScript in a user’s br...

CVE-2024-12641 Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects. Note: This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The...

EulerOS 2.0 SP12 : openssl (EulerOS-SA-2024-2956)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds...

EulerOS 2.0 SP12 : openssl (EulerOS-SA-2024-2941)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds...

CVE-2024-10774

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774

Affected products: SICK InspectorP61x and InspectorP62x (industrial 2D vision sensors). Root cause: unauthenticated CROWN APIs that expose critical functionality. Impact: enables access to large parts of the web application without authentication (potential confidentiality, integrity, and availab...

CVE-2024-53138

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of getpage and pagerefinc APIs to increment the page reference. But on the release path mlx5ektlstxhandleresyncdumpcomp, only putpage is use...

CVE-2024-33039

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service...

CVE-2024-33039 Untrusted Pointer Dereference in Audio

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service...

CVE-2024-52810 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared 10.0.4 is vulnerable to Prototype Pollution through the entry functions lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the globa...

CVE-2024-52810

CVE-2024-52810 covers a Prototype Pollution vulnerability in the package @intlify/shared (v10.0.4). The entry function lib.deepCopy can be fed with a crafted object to pollute the global Object prototype, enabling denial of service and potentially enabling further injection-based attacks if pollu...

CVE-2024-52810 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared 10.0.4 is vulnerable to Prototype Pollution through the entry functions lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the globa...

CVE-2024-52810 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared 10.0.4 is vulnerable to Prototype Pollution through the entry functions lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the globa...

CVE-2024-50357

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial factory default configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server GUI or Web authentication ...