PT-2024-23818 · Open Networking Foundation · Libfluid

Name of the Vulnerable Software and Affected Versions: libfluid version 0.1.0 Description: The issue is an Out-of-bounds Read vulnerability in the Open Networking Foundation ONF libfluid, specifically in the libfluid msg modules. It is associated with the program routines fluid...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when an admin assigns a valuator to a proposal, or does an action that generates an admin activity log. Workaround Users who are not able to upgrade to the fixed version can redirect the pages /admin and...

CVE-2024-8864 composiohq composio calculator.py Calculator code injection

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

CVE-2024-8864 composiohq composio calculator.py Calculator code injection

A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the file python/composio/tools/local/mathematical/actions/calculator.py. The manipulation leads to code injection. The exploit has been...

CVE-2024-8775 Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

CVE-2022-2446

CVE-2022-2446 affects the WP Editor WordPress plugin. The vulnerability is a PHAR deserialization issue via the current_theme_root parameter in versions up to and including 1.2.9. An authenticated attacker with administrative privileges who can upload a serialized payload can trigger deserializat...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (3488039)

Multiple vulnerabilities may be present in SAP NetWeaver Application Server ABAP, including the following: - The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access informati...

CVE-2024-8631 Privilege Defined With Unsafe Actions in GitLab

A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles...

Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2024-2411)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CBL Mariner 2.0 Security Update: unbound (CVE-2024-43168)

The version of unbound installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43168 advisory. - DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software...

nfp: flower: handle acti_netdevs allocation failure

...

Palo Alto Networks PAN-OS 安全漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS, which arises from the exposure of information that allows a GlobalProtect end user to learn the configured GlobalProtec...

PT-2024-31186 · Rely-Pcie · Rely-Pcie

Name of the Vulnerable Software and Affected Versions: RELY-PCIe versions 22.2.1 through 23.1.0 Description: The issue is related to incorrect access control in the mService function at the phpinf.php endpoint. This affects the ability to properly restrict access, potentially leading to...

PT-2024-39177 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS affected versions not specified Description: An information exposure issue exists in the software, allowing a GlobalProtect end user to obtain the configured GlobalProtect uninstall password and the configured disabl...

The vulnerability of the Vijeo Designer software lies in its insecure handling of privileges, allowing attackers to perform arbitrary actions.

The vulnerability of the Vijeo Designer software is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to perform arbitrary actions...

CVE-2024-42423

Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized...

CVE-2024-42423

The CVE-2024-42423 entry concerns Citrix Workspace App 23.9.0.24.4 on Dell ThinOS 2311 with an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local, unauthenticated user with low privileges could bypass controls, potentially leading to information disclosure and ...

ROS-20240910-07

A vulnerability in the snapctl component of the snapd self-contained package management utility is related to incorrect analysis of command line arguments, allowing an unprivileged user to initiate an authorized action on behalf of snapd. to initiate an authorized action on behalf of snap...

Dell SmartFabric OS10 Cross-Site Request Forgery Vulnerability

Dell SmartFabric OS10 is the operating system that runs on Dell EMC network devices and provides a range of networking functions and features. A cross-site request forgery vulnerability exists in Dell SmartFabric OS10, which can be exploited by a remote attacker to submit a specially crafted...

CVE-2024-6853

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack...