PT-2024-6483 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.70 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the V8 JavaScript engine, which could allow a remote attacker to potentially...

CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not...

The vulnerability of the AllJoyn API of the Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the AllJoyn API of the Windows operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Smartplay Headunits 安全漏洞

Smartplay Headunits is a car player from Smartplay. A security vulnerability exists in Smartplay Headunits that stems from the presence of a misconfiguration that could lead to the disclosure of sensitive information...

The vulnerability of the Authentication component of the Windows operating system, which allows a perpetrator to disclose protected information

The vulnerability of the Authentication component in the Windows operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to disclose sensitive information that is protected by security measures...

The vulnerability of the OLE DB driver for SQL Server on Windows operating systems arises from operations that go beyond the buffer boundaries in memory. This allows attackers to exploit the protected information or cause service failures.

The vulnerability of the OLE DB driver for SQL Server on Windows operating systems is related to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information or cause service failures...

CVE-2024-8767

CVE-2024-8767 affects Acronis Backup plugins/extensions for Linux: cPanel & WHM plugin (pre-619), Plesk extension (pre-555), and DirectAdmin plugin (pre-147). Root cause is unnecessary privilege assignment that enables sensitive data disclosure and data manipulation with network access and low pr...

Apache Druid 输入验证错误漏洞

Apache Druid is an American Apache Apache Foundation open source, column-oriented distributed database written in Java. An input validation error vulnerability exists in Apache Druid version 30.0.0 and earlier. An attacker could exploit this vulnerability to read data from other database systems...

The vulnerability of the H5E_printf_stack() function in the H5Eint.c file of the HDF5 library allows a attacker to disclose protected information.

The vulnerability of the H5Eprintfstack function in the H5Eint.c file of the HDF5 library is related to an uncontrolled recursion. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this function...

Intel Processors 安全漏洞

Intel Processors are American Intel Corporation's provide for interpreting computer instructions and processing data in computer software. A security vulnerability exists in Intel Processors that stems from a potential security flaw in the Running Average Power Limit RAPL interface that could lea...

The vulnerability in the `arch/s390/boot/decompressor.c` component of the Linux operating system, related to copying buffers without checking the input data, allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability in the arch/s390/boot/decompressor.c component of the Linux operating system involves copying buffers without checking the input data. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Kortext Best Free Law Office Management Software 安全漏洞

Kortext Best Free Law Office Management Software is a law office management software from Kortext. A security vulnerability exists in Kortext Best Free Law Office Management Software version v1.0, which stems from a sensitive information disclosure issue in the kortexlite/control/registercase.php...

The vulnerability of the miEnumattr() function in the fs/ntfs3 component of the Linux operating system, which allows for buffer copying without checking input data. This vulnerability enables an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the miEnumattr function in the fs/ntfs3 component of the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service...

The vulnerability in the `color.c` component of the `sycc420_to_rgb` function in the OpenJPEG library, related to buffer overflows, allows attackers to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the color.c component in the sycc420torgb function of the OpenJPEG library, which is used for image encoding and decoding, relates to writing beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its...

The vulnerability of the `createNewClientSessionWithId()` function in the `GenericMediaServer` component of the streaming multimedia Live555 library lies in its reliance on memory management after it is freed. This vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the createNewClientSessionWithId function in the GenericMediaServer component of the streaming multimedia Live555 library is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise i...

httpd: Security issues via backend applications whose response headers are malicious or exploitable

A flaw was found in httpd. Backend applications whose response headers are malicious or exploitable may allow information disclosure, server-side request forgery SSRF or local script execution...

KLA73274 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Type confusion vulnerability in V8 can be exploited to cause denial of service. 2. Heap...

CVE-2024-37995

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT 6GT2811-6BC10-2AA0 All versions V4.2, SIMATIC Reader RF610R ETSI 6GT2811-6BC10-0AA0 All versions V4.2, SIMATIC Reader RF610R FCC 6GT2811-6BC10-1AA0 All versions V4.2, SIMATIC Reader RF615R CMIIT 6GT2811-6CC10-2AA0 All versions V4....

CVE-2024-45286

CVE-2024-45286 affects SAP Production and Revenue Accounting, specifically a function module in the obsolete Tobin interface lacking proper authorization checks. This can lead to unauthorized disclosure of highly sensitive data (confidentiality impact HIGH) with no reported impact on integrity or...

PT-2024-7376 · Unknown · Edonline Ems

Name of the Vulnerable Software and Affected Versions: EdOnline EMS affected versions not specified Description: The issue is related to the lack of protection for the SQL query structure in EdOnline EMS, which could allow a remote attacker to disclose protected information. Recommendations: At t...