PT-2024-14694 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the wifi: ath12k driver in the Linux kernel. When the core rfkill config throws an error, it should free the allocated resources. However, it is not freeing the...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to 9.5, which stems from insufficient cleanup of the config parameter in the /applysettings function, allowing an attacker to manipulate...

PT-2024-25806 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.5 Description: A path traversal issue exists in the "save settings" endpoint due to insufficient sanitization of the config parameter in the apply settings function. This allows an attacker to...

CVE-2024-3182

Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2 and 6.2.3 allows user's Enterprise Message Service EMS password to be exposed outside of the hawkagent.cfg and hawkevent.cfg config files...

c-ares: Out of bounds read in ares__read_line()

A vulnerability was found in c-ares where the aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.22.0, the /etc/hosts file. If the configuration files have an embedded NULL character ...

PT-2024-26429 · Tor · Tor Arti +1

Name of the Vulnerable Software and Affected Versions: Tor Arti versions prior to 1.2.3 Description: The issue arises when building anonymizing circuits to or from an onion service with 'lite' or 'full' vanguards enabled, where the circuit manager code builds the circuits with one hop too few. Th...

The vulnerability of the /cgi-bin/upload_config.cgi file in the web interface of the Peplink Smart Reader time tracking and bandwidth management system allows a perpetrator to alter the configuration settings.

The vulnerability of the /cgi-bin/uploadconfig.cgi file of the Peplink Smart Reader web interface is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to modify configurations by sending a specially crafted HTTP request...

PT-2024-24227 · Tibco · Tibco Hawk

Name of the Vulnerable Software and Affected Versions: TIBCO Hawk versions 6.2.0 through 6.2.3 Description: The issue allows a user's Enterprise Message Service EMS password to be exposed outside of the hawkagent.cfg and hawkevent.cfg config files due to an install-type password disclosure...

CVE-2024-34203

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function...

CVE-2024-34201

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function...

CVE-2024-34701 CreateWiki vulnerable to impersonation of wiki requester

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made...

PT-2024-26121

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 1.6.22 Nautobot versions prior to 2.2.4 Description A Nautobot user with admin privileges can modify the BANNER TOP, BANNER BOTTOM, and BANNER LOGIN configuration settings via the "/admin/constance/config/" endpoint...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Business Automation Workflow Configuration Editor

Summary IBM Business Automation Workflow Configuration Editor repackages a vulnerable version of Node.js and express. Vulnerability Details CVEID:CVE-2024-27982 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the use of content length obfuscation in the http server. By...

AZL-40346 CVE-2024-2746 affecting package dnf5 for versions less than 5.1.11-3

Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happened before Polkit...

The vulnerability of the microprogramming software of Mitel series 6800, 6900, 6900w, and 6970 lies in the fact that it allows for the insertion or modification of arguments, enabling an intruder to gain unauthorized access to protected information, alter the phone’s configuration, or execute arbitrary commands.

The vulnerability of the microprogramming software of Mitel series 6800, 6900, 6900w, and 6970 is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information, modify the phone’s configuration,...

PT-2024-4755 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.31.0 Description: The issue is related to a configuration flaw in the exec-path Docker daemon config option, allowing a user in the docker-users group to cause a Windows Denial-of-Service in Windows containe...

Ruijie Networks RG-UAC 操作系统命令注入漏洞

Ruijie Networks RG-UAC is an Internet behavior management and auditing product from China's Ruijie Networks Ruijie Networks. It is used to solve Internet auditing problems. An operating system command injection vulnerability exists in Ruijie Networks RG-UAC 20240428 and earlier versions, which...

SUSE CVE-2024-27042

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 - Device Config Disclosure

Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 1.0.0 Revision 7304 1.0.0 Revision 7284 1.0.0 Revision 6505 1.0.0 Revision 6332 1.0.0 Revision 6258 XS2DAB v1.50 rev 6267 Summary: Cleber offers a...

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link - Device Config Disclosure

Elber Reble610 M/ODU XPIC IP-ASI-SDH Microwave Link Device Config Vendor: Elber S.r.l. Product web page: https://www.elber.it Affected version: 0.01 Revision 0 Summary: The REBLE610 features an accurate hardware design, absence of internal cabling and full modularity. The unit is composed by a...