15220 matches found
xorg-x11-server: Use-after-free in ProcRenderAddGlyphs
A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,...
xorg-x11-server: Use-after-free in ProcRenderAddGlyphs
A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,...
Cisco Integrated Management Controller 操作系统命令注入漏洞
Cisco Integrated Management Controller is the United States Cisco Cisco company's set of software for the management of UCS Unified Computing System. A command injection vulnerability exists in Cisco Integrated Management Controller. The vulnerability allows an authenticated attacker to perform a...
PT-2024-8886 · Zimbra · Zimbra Collaboration Suite
Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite ZCS versions 9.0 through 10.0 Description: The issue is related to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the...
Apache Airflow Information Disclosure Vulnerability (CNVD-2024-20804)
Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions 2.7.0...
PT-2024-11595 · Unknown · Open Source Mano
Name of the Vulnerable Software and Affected Versions: Open Source MANO versions 7 through 12 Description: The issue is related to improper verification of user input, allowing an authenticated attacker to execute arbitrary code within the LCM module container via a Virtual Network Function VNF...
Axefinance Ax Credit Portal SQL注入漏洞
Axefinance Axe Credit Portal is an AI-based end-to-end LOS from Axefinance. An SQL injection vulnerability exists in Axefinance Ax Credit Portal v.3.0 and later versions, which stems from a security issue in the Save Favorites Search feature that allows an authenticated attacker to perform...
CVE-2024-27976
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-27975
An Use-after-free vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-27976
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24999
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24999
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24998
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24997
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-25000
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-23534
An Unrestricted File-upload vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-24992
A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...
CVE-2024-23533
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an authenticated remote attacker to read sensitive information in memory...
CVE-2024-25000
The CVE-2024-25000 entry describes a Path Traversal vulnerability in the Ivanti Avalanche web component prior to version 6.4.3. A remote authenticated attacker can leverage this flaw to execute arbitrary commands as SYSTEM due to improper path validation. Affected product: Ivanti Avalanche (web c...
