VulnCheck KEV: CVE-2024-5057

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12...

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code.

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Chromium: CVE-2024-6988 Use after free in Downloads

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

U.S. Dept Of Defense: Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config

The sensitive data exposure vulnerability allowed an attacker to download thousands of candidate resumes and other confidential files without authentication through a Salesforce community site...

KLA71043 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code, spoof user interface, obtain sensitive information. Below is a complete list of vulnerabilities: 1...

Google Chrome Code Execution Vulnerability (CNVD-2024-33614)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that originates from memory reuse after release in Downloads. An attacker can exploit this vulnerability to execute arbitrary code on the system...

Google Chrome Security Update (stable-channel-update-for-desktop_23-2024-07) - Windows

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Google Chrome Security Update (stable-channel-update-for-desktop_23-2024-07) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that originates from memory reuse after release in Downloads. An attacker can exploit this vulnerability to execute arbitrary code on the system...

The vulnerability of the SINEMA Remote Connect VPN service lies in its ability to download files of a dangerous type without restrictions, allowing a hacker to execute arbitrary code.

The vulnerability of the SINEMA Remote Connect VPN service lies in the ability to download files of a dangerous type without restrictions. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created file...

Google Chrome < 127.0.6533.72 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 127.0.6533.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 202407stable-channel-update-for-desktop23 advisory. - Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a...

PT-2024-5275

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 127.0.6533.72 Microsoft Edge affected versions not specified Description: The issue is related to a use after free in the Downloads component, which can be exploited by a remote attacker to potentially corrupt...

Malicious code in roblox-ts-core (npm)

This package contains a malicious postinstall script which downloads further payloads and delivers QuasarRAT. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e846a11945248574678fe65e4f8cd5b4a766ff129c761b615aef0f0c595fa5 Any computer that has this package installe...

Two of Wallarm’s Open-source Tools Have Been Accepted into Black Hat Arsenal 2024

We're gearing up with some seriously cool stuff for Black Hat! But first, a little sneak peek - not just one, but TWO of Wallarm's open-source tools will be featured in the Arsenal showcase at Black Hat USA this year. Black Hat Arsenal unites researchers and the open-source community to display...

AZL-60199 CVE-2024-6345 affecting package python3 for versions less than 3.9.19-12

A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code...

PT-2024-6812 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.58 Microsoft Edge affected versions not specified Description: The issue is related to incorrect security UI in the Downloads component, allowing a remote attacker to perform UI spoofing via a crafte...

[SECURITY] Fedora 40 Update: yt-dlp-2024.07.02-1.fc40

yt-dlp is a command-line program to download videos from many different online video platforms, such as youtube.com. The project is a fork of youtube-dl with additional features and fixes...

MGASA-2024-0244 Updated python-imageio packages fix security vulnerability

imageio can attempt to download shared freeimage libraries from https://github.com/imageio/imageio-binaries/tree/master/freeimage. The code fetches straight from master and provides no way of verifying whether the correct file was fetched. As a result, if the repository is attacked in the future,...

The vulnerability of the Collection Preview component of the edu-sharing e-learning platform management system allows a perpetrator to execute arbitrary code or trigger a service failure.

The vulnerability of the Collection Preview component in the edu-sharing e-learning platform management system involves unlimited downloading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code using a specially created HTML file, or to...

PT-2024-41055 · Pypi · Imageio

Name of the Vulnerable Software and Affected Versions: imageio affected versions not specified Description: The issue concerns the imageio library, which can download shared freeimage libraries from a GitHub repository. Since the code fetches directly from the master branch without verifying the...