2443 matches found
CVE-2024-24853
Incorrect behavior order in transition between executive monitor and SMI transfer monitor STM in some IntelR Processor may allow a privileged user to potentially enable escalation of privilege via local access...
Checkmk 2.3.0p2 / NagVis 1.9.40 Shell Upload
The NagVis component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP. KL-001-2025-002: Checkmk NagVis Remote Code...
CVE-2024-40891
UNSUPPORTED WHEN ASSIGNED A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00AAFR.4C020170615 could allow an authenticated attacker to execute operating system OS commands on an affected device via Telnet...
CVE-2025-23210
phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....
CVE-2024-20142
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291406;...
Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Active Check
Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...
CVE-2024-13343 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajaxassignnewroles function in all versions up to, and including, 31.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,...
[SECURITY] [DLA 4037-1] openjdk-11 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4037-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort January 31, 2025 https://wiki.debian.org/LTS -...
Security Bulletin: Vulnerability in go-retryablehttp affects watsonx.data
Summary go-retryablehttp could allow a local authenticated attacker to obtain sensitive information. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-6104 DESCRIPTION: go-retryablehttp could allow a local authenticated attacker to obtain sensitive information, caused by the...
Security Bulletin: Vulnerabiity in pillarjs send affects watsonx.data
Summary pillarjs send is vulnerable to cross-site scripting, and this could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-43799 DESCRIPTION: pillarjs send is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...
Security Bulletin: Vulnerability in expressjs serve-static affects watsonx.data
Summary expressjs serve-static is vulnerable to cross-site scripting, and this could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-43800 DESCRIPTION: expressjs serve-static is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker...
Security Bulletin: Vulnerability in pypa/setuptools affects IBM watsonx Assistant for IBM Cloud Pak for Data
Summary A potential vulnerability in pypa/setuptools has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-6345 DESCRIPTION: pypa/setuptools could...
Security Bulletin: Vulnerability in tqdm ( CVE-2024-34062) may affect IBM watsonx Assistant for IBM Cloud Pak for Data
Summary A potential arbitrary code execution vulnerability CVE-2024-34062 has been identified related to tqdm that may affect IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details...
Security Bulletin: PVR0546850 - Express - CVE-2024-45590 (Publicly disclosed vulnerability)
Summary This Security Bulletin is created to reflect the remedian done for PVR0546850 - Express - CVE-2024-45590 Publicly disclosed vulnerability. The 'bodyparser' has been upgraded to version 1.20.3 in PowerHA GUI Rel 7.2.9 in order to resolve this PVR. Vulnerability Details CVEID:CVE-2024-45590...
Security Bulletin: There is a vulnerability in GraphQL Java used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2024-40094)
Summary There is a vulnerability in GraphQL Java used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java is vulnerable to a denial of service, caused by the failure to properly consider...
CVE-2024-40651
In TBD of TBD, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...
Advisory ROSA-SA-2025-2670
software: runc 1.1.7 OS: ROSA-CHROME packageevrstring: runc-1.1.7 CVE-ID: CVE-2024-21626 BDU-ID: 2024-00973 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Runc isolated container launch tool is related to a flaw in the controlled area delimitations of the system. Exploitation of the vulnerabili...
Advisory ROSA-SA-2025-2669
software: python3 3.8.13 WASP: ROSA-CHROME packageevrstring: python3-3.8.13 CVE-ID: CVE-2015-20107 BDU-ID: 2022-03962 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the mailcap module of the Python programming language interpreter is related to insufficient validation of arguments passed to a...
Advisory ROSA-SA-2025-2667
software: sqlite 3.41.2 OS: ROSA-CHROME packageevrstring: sqlite-3.41.2-2 CVE-ID: CVE-2023-7104 BDU-ID: 2024-00480 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the sessionReadRecord function of the ext/session/sqlite3session.c file of the SQLite database management system is related to a buffer...
Advisory ROSA-SA-2025-2648
software: ghostscript 9.54.0 OS: ROSA-CHROME packageevrstring: ghostscript-9.54.0 CVE-ID: CVE-2023-43115 BDU-ID: 2023-06329 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the gdevijs.c component of the Ghostscript document processing software suite is related to incorrect code generation...