CVE-2024-44265

CVE-2024-44265 : The issue affects macOS where an attacker with physical access could input Game Controller events to apps running on a locked device. Apple mitigated this by restricting options offered on a locked device, with the fix delivered in macOS Ventura 13.7.1 and macOS Sonoma 14.7.1. Th...

GHSA-GHJW-32XW-FFWR Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Summary Due to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This was resolved by https://github.com/argoproj/argo-workflows/pull/13641 Details These two lines introduce a data race in the...

Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Summary Due to a race condition in a global variable, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This was resolved by https://github.com/argoproj/argo-workflows/pull/13641 Details These two lines introduce a data race in the...

GO-2024-3212 AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller

AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...

CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...

PT-2024-32838

Name of the Vulnerable Software and Affected Versions Argo Workflows version 3.6.0-rc1 Description Due to a race condition in a global variable, the Argo Workflows controller can be made to crash on-command by any user with access to execute a workflow. This issue can be exploited by creating and...

The vulnerability of the 1C-Bitrix website content management system, related to insufficient protection of registration data, allows a hacker to gain access to the domain controller’s account information.

The vulnerability of the 1C-Bitrix website content management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain access to the account information of the domain controller...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS version 13.7.1, which originates from an attacker with physical access that could feed game controller events to an application...

The vulnerability of the $pconfig variable in the interfaces_groups_edit.php file of the software network interface controller based on the FreeBSD Netgate pfSense operating system allows a hacker to execute arbitrary code.

The vulnerability of the $pconfig variable in the interfacesgroups Edit.php file of the software network interface layer based on the FreeBSD Netgate pfSense operating system is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a remote...

Argo Workflows 安全漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. A security vulnerability exists in Argo Workflows version 3.6.0-rc1, which stems from a race condition in a global variable that allows any user authorized to execute workflows to crash the arg...

CVE-2024-10411

A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCancel/doConfirm/doCancel/doCheckin/doCheckout of the file /marimar/admin/modroom/controller.php. The manipulation of the argument id leads ...

SourceCodester Online Hotel Reservation System 代码问题漏洞

SourceCodester Online Hotel Reservation System is a SourceCodester open source online hotel system. A code issue vulnerability exists in SourceCodester Online Hotel Reservation System version 1.0, which stems from an unrestricted file double-penetration vulnerability in the image parameter of the...

PT-2024-10216

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to 7.1.4191 and 7.2.x prior to 7.2.4996. Description A critical command injection vulnerability in Aviatrix Controller allows unauthenticated attackers to execute arbitrary code due to the improper...

GHSA-J9WP-X5Q5-XH2F Funadmin Cross-site Scripting vulnerability

An issue was found in funadmin 5.0.2. The selectfiles method in \backend\controller\sys\Attachh.php directly stores the passed parameters and values into the param parameter without filtering, resulting in Cross Site Scripting XSS...

Fortinet FortiWeb Stack-based buffer overflows in API controllers (FG-IR-21-152)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-152 advisory. - Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an...

CVE-2024-48237

WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php...

CVE-2024-48239

An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting XSS...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to improper authorization via the add method in controller\Index.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin...

GHSA-2MV8-JJM5-F3HR SQL injection in funadmin

funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the edit method in controller\Table.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issue...