Dell Common Event Enabler 代码问题漏洞

The Dell Common Event Enabler is used to provide a working environment for the Common Antivirus Agent CAVA and Common Event Publishing Agent CEPA programs. A deserialization vulnerability exists in Dell Common Event Enabler. A local attacker could exploit this vulnerability to cause arbitrary cod...

OpenPrinting CUPS Security Vulnerability

OpenPrinting CUPS is a standards-based, open source printing system for Linux® and other Unix®-like operating systems from OpenPrinting, Inc. A security vulnerability exists in OpenPrinting CUPS versions 2.4.8 and earlier, which originates when the cupsd server is started with a Listen...

CVE-2024-23692

creationtimestamp| type| source ---|---|--- 2024-06-10 12:19:13+00:00| published-proof-of-concept| https://t.me/HackingInsights/2058 2024-06-11 12:26:44+00:00| published-proof-of-concept| https://t.me/paiddpam/2899 2024-06-11 17:39:00+00:00| seen|...

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, including the Apex One and Apex One as a Service solutions, allows a malicious actor to trigger a service failure.

The vulnerability of the Damage Cleanup Engine of the Trend Micro Common Client Real-time Scan antivirus software, specifically Apex One and Apex One as a Service, is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow an attacker to...

CVE-2024-4177

creationtimestamp| type| source ---|---|--- 2024-06-09 21:00:45+00:00| seen| https://t.me/HackingInsights/2034...

PHP OS Command Injection Vulnerability

PHP is a scripting language that executes on the server side. PHP suffers from an operating system command injection vulnerability that arises when, under certain conditions, the Windows system replaces characters on the command line with the "Best-Fit" behavior, which may cause the PHP CGI modul...

Malicious code in rey-vue-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 247fab9bb0397ec89a23c30830567d777402a4710831af3d3edfc1c1c6dd2328 The OpenSSF Package Analysis project identified 'rey-vue-common' @ 19.1.2 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1555 Malicious code in rey-vue-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 247fab9bb0397ec89a23c30830567d777402a4710831af3d3edfc1c1c6dd2328 The OpenSSF Package Analysis project identified 'rey-vue-common' @ 19.1.2 npm as malicious. It is considered malicious because: - The package...

UBUNTU-CVE-2023-49441

dnsmasq 2.9 is vulnerable to Integer Overflow via forwardquery...

CVE-2024-3820

creationtimestamp| type| source ---|---|--- 2024-06-03 20:07:53+00:00| seen| https://t.me/HackingInsights/1447...

CVE-2023-48789

Fortinet FortiPortal suffers a vulnerability (CVE-2023-48789) due to client-side enforcement of server-side security that can allow improper access control via specially crafted HTTP requests. Affected software: FortiPortal versions 6.0.0 through 6.0.14. Root cause: insecure client-side security ...

RHEL 8 : aspell (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - aspell: UCS-2 and UCS-4 null-terminated string handling OOB read CVE-2019-20433 - libaspell.a in GNU Aspe...

CVE-2023-44352

creationtimestamp| type| source ---|---|--- 2024-06-02 17:16:13+00:00| published-proof-of-concept| https://t.me/brutsecurity/455...

CVE-2024-27776

CVE-2024-27776 affects MileSight DeviceHub. The issue is a CWE-22 path traversal vulnerability that may allow unauthenticated remote code execution over the network (no user interaction) with a CVSS v3.1 base score of 9.8 (CRITICAL). Root cause is improper limitation of a pathname to a restricted...

ruby/cgi-gem: HTTP response splitting in CGI

A vulnerability was found in Ruby that allows HTTP header injection. A CGI application using the CGI library may insert untrusted input into the HTTP response header. This issue can allow an attacker to insert a newline character to split a header and inject malicious content to deceive clients...

CVE-2024-4358

creationtimestamp| type| source ---|---|--- 2024-05-30 13:10:48+00:00| published-proof-of-concept| https://t.me/HackingInsights/1164 2024-06-03 12:53:24+00:00| published-proof-of-concept| https://t.me/orderofsixangles/2311 2024-06-04 09:30:41+00:00| seen| https://t.me/lostsec/565 2024-06-04...

CVE-2024-24919

creationtimestamp| type| source ---|---|--- 2024-05-29 13:46:26+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus15/2024 2024-05-29 16:46:33+00:00| exploited| https://t.me/CyberSecurityIL/46168 2024-05-29 17:17:29+00:00| seen|...

kernel: cifs: fix underflow in parse_server_interfaces()

In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parseserverinterfaces In this loop, we step through the buffer and after each item we check if the sizeleft is greater than the minimum size we need. However, the problem is that "bytesleft" is type ssizet...

silverstripe/framework allows upload of dangerous file types

Some potentially dangerous file types exist in File.allowedextensions which could allow a malicious CMS user to upload files that then get executed in the security context of the website. We have removed the ability to upload .css, .js, .potm, .dotm, .xltm and .jar files in the default...

silverstripe/framework uploaded PHP script execution in assets

A weakness in the .htaccess rules preventing requests to uploaded PHP scripts allows PHP scripts that had made their way into the assets directory to be successfully executed through the use of a specially crafted URL. There are protections in place to disallow upload of PHP scripts through the...