Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 18.1 and Apple iPadOS version 18.1, which originates from an...

PT-2024-31080 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.1 macOS Ventura versions prior to 13.7.1 macOS Sonoma versions prior to 14.7.1 iOS versions prior to 18.1 iPadOS versions prior to 18.1 Description: The issue allows an app to potentially access sensitive user dat...

The vulnerability of the Java VM component of the Oracle Database Server allows a perpetrator to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Java VM component of the Oracle Database Server management system is related to insufficient protection of operational data due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

Fortinet FortiWeb ] Format string vulnerability found on multiple paths (FG-IR-20-123)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-123 advisory. - A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the conten...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection due to improper authorization via the add method in controller\Index.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through list method in curd\controller\Table.php file. An attacker can manipulate SQL queries and access or modify data in the database. Remediation There is no fixed version for funadmin/funadmin. References - GitHub Issu...

CVE-2024-49766

CVE-2024-49766 — Werkzeug UNC Path Validation Issue : Werkzeug on Windows with Python <3.11 fails to catch UNC paths in os.path.isabs(), causing safe_join() to produce potentially unsafe paths. Vulnerable scenarios affect apps using Python =3.11 or non-Windows environments are not affected. A ...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2024-49766 Werkzeug safe_join not safe on Windows

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

ROS-20241025-02

Vulnerability of usb-audio component of Linux kernel is related to NULL pointer dereferencing in the sndusbsetsampleratev2v3 function in sound/usb/clock.c. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the target component of the target...

Cisco Secure Firewall Management Center SQL Injection Vulnerability

Cisco Secure Firewall Management Center FMC is a comprehensive, centralized management platform for Cisco's network security solutions. It provides unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection. An SQL injection...

Pinterest tracks users without consent, alleges complaint

Pinterest has received a complaint from privacy watchdog noyb None of your business over the unsolicited tracking of its users. Pinterest allows you to pin images to virtual pinboards; useful for interior design, recipe ideas, party inspiration, and much more. It started as a virtual replacement...

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle Database Management System allows a hacker to gain access to read, modify, or delete data, or to cause service interruptions.

The vulnerability of the Connector/ODBC driver for MySQL Connectors in the Oracle MySQL database management system is related to deficiencies in the authentication process due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker to gain read, modify, or delet...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from insufficient protection of sensitive data in the source code. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient protection of sensitive data in the source code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected informati...

PT-2024-33137 · Neye3C · Neye3C

Name of the Vulnerable Software and Affected Versions: Neye3C version 4.5.2.0 Description: The issue concerns incorrect access control in the firmware update and download processes, allowing attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-20472

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validat...

CVE-2024-20471

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validat...

CVE-2024-9829

The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwaphandledownloaduser' and 'dpwaphandledownloadcomment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, wit...

CVE-2024-9829

CVE-2024-9829 — WordPress Download Plugin (≤ v2.2.0) suffers missing capability checks in dpwap_handle_download_user and dpwap_handle_download_comment, enabling authenticated users with Subscriber+ rights to download any comment and metadata including user PII, emails, hashed passwords, app token...

Cisco Firepower Management Center 安全漏洞

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A cross-site scripting vulnerability exists in Cisco Firepower Management Center, which arises from insufficient validation of user-supplied input in the web management interface, and can ...